Malicious PDF — malware analysis report

Static analysis result for SHA-256 af3f7a5dab055d9e…

MALICIOUS

PDF

184.5 KB Created: 2015-07-24 12:34:15 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: e1315edb1f5c7e1e8323060afd3357f1 SHA-1: 65f59305174cb349b1b00afd118a8d7da8108db7 SHA-256: af3f7a5dab055d9ec2a759d11be46b305477759c6eee4e07809bad4500331de3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, botcraftman.ru. This indicates the document is designed to lure the user to a potentially harmful website. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, and the document body was truncated and unreadable, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B0%D1%81%D1%81%D0%B0%D1%81%D0%B8%D0%BD+2+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img1.liveinternet.ru/images/attach/c/5//4191/4191300_skachat_sbornik_klubnoy_muzuyki_2012_torrent.pdf
    • http://img1.liveinternet.ru/images/attach/c/5//4187/4187116_oomph_diskografiya_19922012_skachat_torrent_mp3.pdf
    • http://img0.liveinternet.ru/images/attach/c/5//4188/4188632_skachat_futbolnuyy_menedzher_2007_cherez_torrent_na_russkom.pdf

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000240b4.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x240B4 3556 bytes
font_01_sfnt_off00024e37.bin
2dac548664d816574aec3bddd80afaaab9f3ca6b9ddf646a85ea7fefd5ba10ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24E37 14744 bytes
font_02_sfnt_off00027bc0.bin
a8c28ff59a65b28ee09e50dd1c7720660447add6a998d01502f877442c6e77ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27BC0 14468 bytes
font_03_sfnt_off0002a672.bin
f43ecaa849edfa48d0974fc387f46cfcfb5c6dd19cae8888986280e9dcbc763c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A672 6256 bytes
font_04_sfnt_off0002b81a.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B81A 6084 bytes
font_05_sfnt_off0002c7af.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C7AF 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.