Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2e56c3b85f97e02…

MALICIOUS

PDF

357.2 KB Created: 2015-08-26 10:41:44 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2026-06-05
MD5: 383383039ae8fa2cc6a1ef827dfd6657 SHA-1: 4762290415b2cd13af32ec15d07cd54a100b311a SHA-256: c2e56c3b85f97e021adb37367308816b9cdb6623363411a8d4df0d20a2fc8849
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a link to a known malicious redirector, botcraftman.ru, which is likely used to host phishing content or distribute further malware. The ML classifier also strongly indicated maliciousness. While no scripts were directly extracted, the presence of a malicious URL within the PDF structure suggests an attempt to redirect the user to a harmful site, potentially as part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B8%D1%84%D0%B8%D0%BA%D0%B0%D1%82%D0%BE%D1%80+%D0%BA%D0%BB%D1%8E%D1%87%D0%B0+%D0%BD%D0%B5+%D1%81%D0%BE%D0%B2%D0%BF%D0%B0%D0%B4%D0%B0%D0%B5%D1%82+%D1%81+%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B8%D1%84%D0%B8%D0%BA%D0%B0%D1%82%D0%BE%D1%80%D0%BE%D0%BC+%D0%BA%D0%BE%D0%BC%D0%BF%D1%8C%D1%8E%D1%82%D0%B5%D1%80%D0%B0+cronos&charset=utf-8 In PDF document text
    • http://botcraftman.ru/?lip&keyword=%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B8%D1%84%D0%B8%D0%BA%D0%B0%D1%82%D0%BE%D1%80+%D0%BA%D0%BB%D1%8E%D1%87%D0%B0+%D0%BD%D0%B5+%D1%81%D0%BE%D0%B2%D0%BF%D0%B0%D0%B4%D0%B0%D0%B5%D1%82+%D1%81+%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B8%D1%84%D0%B8%D0%BA%D0%B0%D1%82%D0%BE%D1%80%DIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4752/4752610_chituy__na__world_.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4752/4752185_klyuch__na__kasperskiy_.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4752/4752990_dogovor__podryada__ip_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00054d23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54D23 8904 bytes
SHA-256: 8740e8d3a8ff3ef4f7833b57a8d858e8cfafa3dad70bbfef6eef825b25b85942
font_01_sfnt_off00056601.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56601 14892 bytes
SHA-256: c3e6be5ae47197a9e5df8a59f876c1c7e9afb8b8d2947e3711e0f22e0b6ad575

Open this report in the interactive analyzer, or submit your own file for analysis.