Malicious PDF — malware analysis report

Static analysis result for SHA-256 d28607a0b6fc9e2a…

MALICIOUS

PDF

349.7 KB Created: 2015-08-26 09:52:22 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 8398c1e515b74fc7cb1223dbf9f5677d SHA-1: d1bbdb3063c0ab0f0c8ac8bd4fc4baf892609413 SHA-256: d28607a0b6fc9e2a0e19e2b9d224b641148bd24423d70acad3de53553d9a026f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing indicating a link to a known malicious redirector. The embedded URL 'http://botcraftman.ru/?lip&keyword=3gswexe+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE&charset=utf-8' is the primary indicator of malicious intent. This suggests the document is designed to lure users to a potentially harmful website.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=3gswexe+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4751/4751763_kak__oformit__titulnuyy_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4751/4751664_metodicheskie__rekomendacii__napisaniya_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4751/4751701_velikolepnuyy__vek__1_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00052fb1.bin
18fea523c5f9280143e7820070de8544ace348788a69fbb92bed1f66926e750d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52FB1 8812 bytes
font_01_sfnt_off0005488a.bin
fbf24f7d1a18fab6aef28ad3883a262d5fdc72be5aa91621f1a6edfc80e84be3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5488A 15272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.