Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca8e8a679460b756…

MALICIOUS

PDF

355.4 KB Created: 2015-08-28 13:24:17 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: ad1dd263cbb2eb5a9edac08ffc08cae7 SHA-1: 35993e98d207b279ed2c324e2b7d11b2425e1f29 SHA-256: ca8e8a679460b756e62fde5a86d08910834dd26db30d1e8b686873fdee2406a8
98 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics as malicious, including a critical finding for a link to known malicious redirector infrastructure. The embedded JavaScript stream and the ML classifier further support the malicious nature of the file. The primary IOC is the malicious URL, which is likely used to direct the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9943

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%82%D0%B0%D0%B1%D0%BB%D0%B8%D1%86%D0%B0+%D1%81%D0%B8%D0%BD%D1%83%D1%81%D0%BE%D0%B2+%D0%B8+%D0%BA%D0%BE%D1%81%D0%B8%D0%BD%D1%83%D1%81%D0%BE%D0%B2+%D1%82%D0%B0%D0%BD%D0%B3%D0%B5%D0%BD%D1%81%D0%BE%D0%B2+30+45+60+120+135+150+90&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4802/4802564_sensornoe__pianino__onlayn_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4802/4802464_forma__182n_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4803/4803166_skachat__programmu__dlya_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00054a32.bin
74d9b3113c90fc9ccce884b276fe6a0817d71613b74606bb02cfb62063049f9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54A32 7848 bytes
font_01_sfnt_off0005616d.bin
a9f087e4b10063c1dfe50006838cd05e65b388077cabd075adcb4b4510d77a6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5616D 13744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.