Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2d366d98adc09a2…

MALICIOUS

PDF

362.0 KB Created: 2015-08-29 11:34:54 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-07-13
MD5: d17b1fd4b2c9076cb733750667f212ec SHA-1: 05aa6e4eb1f7e15d30ef427675bd1320e65cea53 SHA-256: f2d366d98adc09a255ad2e9048761daacf846130d6a5280abe5303a501e48cab
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lure the user to a harmful site. While no scripts were explicitly extracted, the presence of embedded URLs and the ML classification strongly suggest malicious intent. The document's structure and embedded content do not provide further clues about the specific payload or family.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%BA%D0%B0%D0%BB%D0%B5%D0%BD%D0%B4%D0%B0%D1%80%D0%BD%D0%BE+%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%BE%D0%B5+%D0%BF%D0%BB%D0%B0%D0%BD%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5+%D0%BF%D0%BE+%D0%B1%D0%B8%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D0%B8+10+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%B1%D0%B5%D0%BB%D1%8F%D0%B5%D0%B2+%D0%B4%D1%8B%D0%BC%D1%88%D0%B8%D1%86&charset=utf-8 In PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4830/4830572_vyatgu__oficialnuyy__sayt_.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4830/4830534_skachat__vzlomannuyy__angry_.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4830/4830202_skachat__whatsapp_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00055a5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55A5A 9860 bytes
SHA-256: caaf94bcbcce4fc3088bc5366ed4c8d587e491e929e6ee9b3a8941c110afed77
font_01_sfnt_off0005771e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5771E 15984 bytes
SHA-256: f82ba328b22671ca3adcfb9ec24749c52d836752aa98f7866391a44b8e40cabb

Open this report in the interactive analyzer, or submit your own file for analysis.