Malicious PDF — malware analysis report

Static analysis result for SHA-256 d664e3251f3229b6…

MALICIOUS

PDF

186.3 KB Created: 2015-07-24 04:46:13 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: 2713f6cbbbe3001e863d8f51238ddd80 SHA-1: cb72cf2790498965f1f1d4d02bc619d555774923 SHA-256: d664e3251f3229b6dc1ec7a82e0565f1dc337404123f7b5e570ef52e157ecda3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics as malicious, specifically due to an embedded link pointing to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. The primary IOC is the malicious URL, which is likely used to deliver a secondary payload or redirect to a phishing page. No scripts were extracted, limiting further analysis of the attack chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B1%D0%BB%D0%B0%D0%BD%D0%BA+%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F+%D0%BD%D0%B0+%D0%B2%D1%8B%D0%BF%D0%B8%D1%81%D0%BA%D1%83+%D0%B8%D0%B7+%D0%B5%D0%B3%D1%80%D0%B8%D0%BF&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img0.liveinternet.ru/images/attach/c/5//4184/4184882_skachat_kontakt_master_polnuyu_versiyu_dlya_vzloma.pdf
    • http://img1.liveinternet.ru/images/attach/c/5//4185/4185827_skachat_abbyy_finereader_10_besplatno_s_klyuchom_dlya_aktivacii.pdf
    • http://img1.liveinternet.ru/images/attach/c/5//4185/4185081_d3dx9_43dll_skachat_dlya_windows_7_besplatno.pdf

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000244f4.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x244F4 3556 bytes
font_01_sfnt_off00025277.bin
45b473bbd37cff3b2c436dd858227bf610b1c4870f38072190609fd2bd699112		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25277 15376 bytes
font_02_sfnt_off000281cc.bin
163142455a5560a1f6759d0ead96de5f50a47653c77b96353ea21901cf90e8c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x281CC 14468 bytes
font_03_sfnt_off0002ac80.bin
677f1aa99bf405079901ee39342743b10bd6d0db978fe395e0368f093f34a629		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AC80 6628 bytes
font_04_sfnt_off0002bf6f.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BF6F 6084 bytes
font_05_sfnt_off0002cf04.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CF04 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.