Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1f8ae883b0ebb33…

MALICIOUS

PDF

367.1 KB Created: 2015-08-23 21:11:50 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 5a8a07178a56017bb8f8da18de135101 SHA-1: e42c5ea5b569ce15723dc943cff09f9ffa19615e SHA-256: f1f8ae883b0ebb330cbb9a97e49b7bbf00a6f90ff170cfc524f74d119c78ea72
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, indicating a likely attempt to lure the user to a harmful website. The document body is heavily obfuscated and does not provide clear textual clues about its purpose. No scripts were extracted from this sample. The primary threat identified is the malicious URL.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B6%D0%B5%D0%BA%D0%B0+%D0%BA%D1%82%D0%BE+%D1%82%D0%B0%D0%BC+%D0%B4%D1%8F%D0%B4%D1%8F+%D1%84%D0%B5%D0%B4%D0%BE%D1%80+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B0%D0%BB%D1%8C%D0%B1%D0%BE%D0%BC&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4690/4690184_edinstvennaya__zhenschina__na_.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4690/4690217_lezginskiy__yazuyk_.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4690/4690041_skachat__programmu__kloun_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00057bbe.bin
80bf5750a15fae8ccb28fb543ddb27e52a0892c14c4194252192071beb8cefad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57BBE 8592 bytes
font_01_sfnt_off0005945f.bin
2f7871158e9c22371d623f5add98bda6254d0c6f4ead15dcf8c9195d2712d4a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5945F 12612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.