Malicious PDF — malware analysis report

Static analysis result for SHA-256 c20a3037e8e2c68f…

MALICIOUS

PDF

370.3 KB Created: 2015-08-20 10:43:07 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 4bf0bc7b611ed5d961e85e574adebfed SHA-1: 1c5cac3f480badce7564d6d0cde2cfc70ee3ea4b SHA-256: c20a3037e8e2c68f64bc6f8536a87bd782c73686d2887d4938b463714df4eb16
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains an embedded link that is flagged as a malicious redirector. This indicates the document is likely a lure to direct the user to a malicious website for phishing or malware download. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific lure.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B8%D0%B3%D1%80%D1%83+%D0%BF%D0%B0%D1%80%D0%BA+%D1%8E%D1%80%D1%81%D0%BA%D0%BE%D0%B3%D0%BE+%D0%BF%D0%B5%D1%80%D0%B8%D0%BE%D0%B4%D0%B0+%D1%87%D0%B5%D1%80%D0%B5%D0%B7+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4641/4641368_skachat_whatsapp_dlya_nokia_c3_01_5.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638804_yuniti_pleer_skachat_besplatno_dlya_kontra_siti.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4639/4639717_testuy_cpd_mvd_skachat_cherez_torrent.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00057f40.bin
4cf89417c6cf46396dd7005030d4e57dab3c53c75c5e506ed4efb77805fafe60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57F40 8376 bytes
font_01_sfnt_off00059739.bin
7dee1a466c9b0b01643d812834c477de00584daea3b0a31adcf7e089d253348f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59739 16520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.