PDF malware analysis — malicious · bcd893ceecf28217

MALICIOUS

PDF

350.7 KB Created: 2015-08-21 09:15:40 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)

MD5: 5483daf8d059007a6793bc9c72b170e8 SHA-1: 835b9c65c2cbeeaf85b8d57831b10a8ef97af2bf SHA-256: bcd893ceecf28217f81fec00319a13451fe9fbdb2eccbfad4acaac716638981f

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector. The document body, though heavily obfuscated, contains text referencing 'Patek philippe geneve 58152' and 'инструкция', suggesting a lure related to luxury goods. The heuristic firing confirms the presence of a malicious redirector link, indicating an attempt to lead the user to a compromised or malicious site.

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://botcraftman.ru/?lip&keyword=Patek+philippe+geneve+58152+%D0%B8%D0%BD%D1%81%D1%82%D1%80%D1%83%D0%BA%D1%86%D0%B8%D1%8F&charset=utf-8
- http://img0.liveinternet.ru/images/attach/c/6//4654/4654676_chek_order_sberbanka_shrift.pdf
- http://img0.liveinternet.ru/images/attach/c/6//4654/4654677_skachat_gta_san_andreas_multipleer_03e_torrent.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000531f2.bin` `91c7766a303133b7abe15cc031874fff4ac11a8d45bcb7f22afa030b41985dac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x531F2	10400 bytes
`font_01_sfnt_off00054ee9.bin` `bf376051a5fcae97f5c328bd08f55cacc557f6b35c8f8879f5b5e5dd262ed674`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54EE9	14636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.