MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a link to a known malicious redirector. This heuristic indicates the document is designed to trick the user into visiting a harmful site, likely for credential harvesting or malware delivery. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.
Heuristics 2
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://botcraftman.ru/?lip&keyword=wetransfer+%D1%84%D0%B0%D0%B9%D0%BB%D0%BE%D0%BE%D0%B1%D0%BC%D0%B5%D0%BD%D0%BD%D0%B8%D0%BA+%D0%BD%D0%B0+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC+%D1%8F%D0%B7%D1%8B%D0%BA%D0%B5&charset=utf-8
- http://img0.liveinternet.ru/images/attach/c/6//4654/4654680_perevod_teksta_s_angliyskogo_na_russkiy_6_klass_spotlight.pdf
- http://img0.liveinternet.ru/images/attach/c/6//4654/4654677_skachat_gta_san_andreas_multipleer_03e_torrent.pdf
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00054693.bin07d49924727b8a45313ce0cf78b1cafca825043aadc84c90d817232f9e3a46ea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x54693 | 10612 bytes |
font_01_sfnt_off0005637f.binbe6e449f38b4e4daabe96f8632f636ad1efa54bcfee4879e22d478fa643eba36 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5637F | 15816 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.