Malicious PDF — malware analysis report

Static analysis result for SHA-256 c086b5f6e9dfe600…

MALICIOUS

PDF

363.3 KB Created: 2015-08-27 09:50:52 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 3ec0abedc86f16e58d2844e6eb299a5b SHA-1: 0cc15e329f123cf668c16a1e1d21150a1ccd37a8 SHA-256: c086b5f6e9dfe600cf61bab16036f6fe71e167642ec4153ff2e8309633dce05d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link to a known malicious redirector infrastructure. The heuristic firing 'PDF_MALICIOUS_REDIRECTOR_LINK' directly indicates this malicious behavior. The embedded URL is the primary indicator of compromise, suggesting the document's purpose is to lure the user to a potentially harmful site.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=commander+the+great+war+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4772/4772081_igruy__pesochnicuy__na_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4771/4771831_skachat__nodvd__dlya_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4771/4771945_htc__mozart__windows_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00055ec4.bin
1c968af2f65a27da888d4bd3498dd9c7122c741dc2d00c239f86483e2aa1ebca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55EC4 10208 bytes
font_01_sfnt_off00057acc.bin
190a96841e70cc3a0b8518e30c15034684f2337eca6c5f831429e21ca82af788		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57ACC 16852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.