Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc87a3eeb65f4e56…

MALICIOUS

PDF

183.7 KB Created: 2015-08-09 08:34:20 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: 50771eb92d3f739dc2ac8010f9b9e2e0 SHA-1: 9ad09757160b79ddf3d5d62ccc330f987c4269a0 SHA-256: fc87a3eeb65f4e561de9dae76031f2183e5d46d990d4f372486a26d141710991
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, http://botcraftman.ru/. This indicates the document is likely intended to lure users to a malicious site for phishing or malware download. No scripts were extracted, and the document body was truncated, limiting further analysis of the exact payload.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B1%D0%B0%D0%B3%D0%B8+%D0%BB%D0%B02+%D1%85%D0%B0%D0%B9+%D1%84%D0%B0%D0%B9%D0%B2&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img0.liveinternet.ru/images/attach/c/6//4388/4388841_skachat_besplatno_film_zdravstvuy_mama.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4392/4392407_skachat_torrent_tri_metra_nad_urovnem_neba_2.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4399/4399437_evangelie_ot_dionisiya_skachat.pdf

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00023f03.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23F03 3556 bytes
font_01_sfnt_off00024c86.bin
5737d904afe1c360dcbbd9d72eca7d9d6c422b672999d56d0bdcb394915f4c6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24C86 14140 bytes
font_02_sfnt_off000278e5.bin
ef8a6256e321cf931ce41cbec56c973ed0f837592366dea4ee2be5161a32f45d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x278E5 14532 bytes
font_03_sfnt_off0002a3d5.bin
4d3cb6feb2301c7707b5edb48455c0726dcb113c3a8acc856dab651742505f3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A3D5 6104 bytes
font_04_sfnt_off0002b4d0.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B4D0 6084 bytes
font_05_sfnt_off0002c465.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C465 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.