Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2cfddc5dab4241a…

MALICIOUS

PDF

383.4 KB Created: 2015-08-20 07:16:15 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 76ac2fc723a5d00cd76303783762946b SHA-1: becc6cc4ca8aafbb53299e70f1f42ce42b851169 SHA-256: e2cfddc5dab4241a83af9079d761a8537df7c6b72d1d613c956d72e517876103
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by ClamAV as Pdf.Dropper.Agent-8790172-0, indicating it is a known dropper. A critical heuristic identified a malicious redirector link within the document body pointing to http://botcraftman.ru/. This suggests the PDF is intended to lure users to a malicious site, likely for further exploitation or credential harvesting.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-8790172-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8790172-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%BC%D0%BE%D0%B1%D0%B8%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9+%D0%BA%D1%80%D0%B8%D0%BC%D0%B8%D0%BD%D0%B0%D0%BB%D0%B8%D1%81%D1%82+2015+crack&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638795_skachat_rut_dlya_gamekiller.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638791_mt65xx_preloader_skachat.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638793_rezultatuy_egye_po_russkomu_yazuyku_2015_god.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005b21f.bin
1f7dcaba72dd032ee62ade4673b9784b5a15e8f6a291b49661c7c49c9bc62a90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B21F 8940 bytes
font_01_sfnt_off0005cb12.bin
6a24705479b21ddd6daa2cd7914ad7a102c1306f36b9a1b263906adcb365881d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CB12 17232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.