Malicious PDF — malware analysis report

Static analysis result for SHA-256 c109ed27a764ce24…

MALICIOUS

PDF

370.1 KB Created: 2015-08-25 09:33:15 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 100d48e2f4cff4f7e3b8af1fcdf2376a SHA-1: 98ef35691bf6dd06f2d9a5b5b4ac31d029d06081 SHA-256: c109ed27a764ce24bdcb4841cf162b64578f52aa063bfbd0f3ccd13bdf10cab5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a critical heuristic for linking to known malicious redirector infrastructure. The embedded URL, http://botcraftman.ru/..., is identified as a malicious redirector. The document body contains garbled text, suggesting it may be obfuscated or intended for a non-human reader, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9943

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE+%D0%BA%D0%B0%D1%80%D1%82%D1%8B+%D0%BD%D0%B0%D1%80%D1%83%D1%82%D0%BE+%D0%B4%D0%BB%D1%8F+warcraft+3+frozen+throne&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4725/4725227_vzlomat__igru__celuy_.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4726/4726279_chem__otkruyt__fayl_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4725/4725973_skachat__kartinki_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00057c5a.bin
0dc47eaf5417f3c9cb8b652d386e6ef0e592de8655685c631404879aac8ab68a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57C5A 9600 bytes
font_01_sfnt_off000596cb.bin
a17f3c36cc597cea32e4ccf0118e7e806a184e1993b043f47cc1720430e7ff20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x596CB 16192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.