Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac9f70468343845d…

MALICIOUS

PDF

370.4 KB Created: 2015-08-27 10:32:38 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 3835fb6c12abb99d792f963410efc823 SHA-1: c5d6110248bbd83490d6782199a9c4cb650cbac8 SHA-256: ac9f70468343845d86c7d990d8b4e79ff0619a07c7e671c40d10522df15d4190
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains an embedded link to a known malicious redirector. The ML classifier also flagged this PDF with high confidence. The primary attack vector appears to be luring the user to the malicious URL, which is likely intended to deliver a second-stage payload or conduct a phishing attack. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BC%D0%B5%D1%80%D1%82%D1%8C+%D1%88%D0%BF%D0%B8%D0%BE%D0%BD%D0%B0%D0%BC+%D0%BA%D0%BB%D1%8E%D1%87+%D0%B4%D0%B8%D1%81%D0%BA%D0%B0&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4772/4772576_skachat__chit__na_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4772/4772655_skachat__starbound__beta_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4772/4772202_skachat__moduy__na_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000578ea.bin
ef1bdfb6396ecb4ef97352a5750ddb594568a4ff8e7e920b87b23aac4166e158		 pdf-font-stream PDF embedded font (sfnt) at offset 0x578EA 8308 bytes
font_01_sfnt_off00059106.bin
df62aa70f3f3f026a42552a41d88513e8f755ab501fd48c53c32b0d745883bde		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59106 19376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.