PDF malware analysis — malicious · ace1c0f1686ea1a0

MALICIOUS

PDF

344.1 KB Created: 2015-08-23 20:52:14 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)

MD5: bb10f0b3997690026467e80b243ffe7f SHA-1: 34ae7b013f4c7ad7fdceb6515d9086bb27261a59 SHA-256: ace1c0f1686ea1a04deee5591defda73e65da2944415494f1f2fbcb69f1db9db

60 Risk Score

Malware Insights

MITRE ATT&CK

T1200 Hardware Add-in T1059 Command and Scripting Interpreter

The PDF file contains a link to a known malicious redirector. The heuristic firing 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates that this URL is associated with malicious activity. The document body appears to be malformed or heavily obfuscated, providing no clear user-facing content, but the presence of the malicious link is sufficient evidence of malicious intent. The file was likely intended to lure the user to the specified URL, which could then serve further malicious content.

Machine Learning

Nyx PDF Classifier suspicious score 0.3304

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://botcraftman.ru/?lip&keyword=80211n+wlan+adapter+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B4%D1%80%D0%B0%D0%B9%D0%B2%D0%B5%D1%80&charset=utf-8

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00051c00.bin` `eceaf023dd5fec52eac5fb481c307c4634cfd80b33732a62281816a594bfddfe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51C00	9792 bytes
`font_01_sfnt_off00053773.bin` `bb2747d0346659e26429bb007121843dfe3d5be3631c95b368e22528536e9b72`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x53773	13476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.