Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca940972ab0a3105…

MALICIOUS

PDF

371.2 KB Created: 2015-08-22 09:40:25 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-09-18
MD5: ca41e3fb16b97dc6b9523ec52ad609f2 SHA-1: 25bca388c377f6cc4a53e59bb438fa0e4959321e SHA-256: ca940972ab0a31054adcfc2ec5734e09e1652a2c8243622f9960793abd94d9a9
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that redirect to known malicious infrastructure, specifically advertising cracked software. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the presence of malicious redirector links suggests an attempt to deliver a second-stage payload or phish the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B0%D1%8F+%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%BC%D0%B0+%D0%BF%D0%BE+%D0%BB%D0%B8%D1%82%D0%B5%D1%80%D0%B0%D1%82%D1%83%D1%80%D0%B5+10+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BA%D0%BE%D1%80%D0%BE%D0%B2%D0%B8%D0%BD%D0%B0+102+%D1%87%D0%B0%D1%81%D0%B0&charset=utf-8 In PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4674/4674955_autocad_portable_2015_rus_torrent.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/6//4675/4675053_chernobuyl_zona_otchuzhdeniya_skachat_torrent_2015_film.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4674/4674627_skachat_pokemonuy_5_sezon_cherez_torrent.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000585d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x585D1 9000 bytes
SHA-256: c4dd555e64ac3d0d5b266e714ae0d51444dc1f62ec9d0fcadebcbdc333d214fd
font_01_sfnt_off00059f9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59F9E 14248 bytes
SHA-256: ded9d3ed7cf980a7b5aff8c4565739bd10b674fed2077ce69e8f5c149b2d013f

Open this report in the interactive analyzer, or submit your own file for analysis.