Malicious PDF — malware analysis report

Static analysis result for SHA-256 d36e5d0766c5ce91…

MALICIOUS

PDF

367.7 KB Created: 2015-08-26 10:17:26 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 57f2b12a814e776bf884a7db1e8d7f7b SHA-1: 84e9fe339b1c6293e0e68998ba939a3f05704c96 SHA-256: d36e5d0766c5ce9134b24d5b012ea8596d7ea54f5e558b032b052835bb990f9e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, botcraftman.ru. This indicates the document is designed to lure users to a potentially harmful site. The document body is heavily obfuscated, preventing a clear understanding of its specific content or intent beyond the malicious redirect. No scripts were extracted from this sample.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%87%D0%B8%D1%82%D1%8B+%D0%BD%D0%B0+world+poker+club+%D0%B2%D0%BA%D0%BE%D0%BD%D1%82%D0%B0%D0%BA%D1%82%D0%B5&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4751/4751795_istoriya__kazahstana__9_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4752/4752367_shemuy__vuyshivki__krestom_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4751/4751768_skachat__zagruzochnuyy__disk_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000574d6.bin
a6464506a06c4a30c66501d11315f2a8832e1f43f67fa75b44a2878c60aa26da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x574D6 9436 bytes
font_01_sfnt_off00058f19.bin
0a6b34b029b47ca6e88f977782509950a0df3ffcb3ff0793fa086e3097224e49		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58F19 15556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.