Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe016cbbb57c7e71…

MALICIOUS

PDF

381.3 KB Created: 2015-08-29 01:21:32 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 148d51c8d8cf519d5e64db1e90625e2c SHA-1: c5e70736f10d74aa618da91731bc6a09e76277c7 SHA-256: fe016cbbb57c7e7168b98a5ca77bad4793388c139a8ea2bd00ed6ca39b1b3cf2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, http://botcraftman.ru/, which is a strong indicator of malicious intent. The ML classifier also flagged this PDF with high confidence. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its specific lure, but the presence of the malicious URL strongly suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=spb+tv+%D0%B4%D0%BB%D1%8F+%D0%BA%D0%BE%D0%BC%D0%BF%D1%8C%D1%8E%D1%82%D0%B5%D1%80%D0%B0+windows+xp&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4818/4818019_uaz__polnuyy__privod_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4818/4818063_3d__instruktor__227_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4817/4817682_tridcatiletnie__skachat_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005a859.bin
3757878a78c2e8fbacadd6a1881eb7259072cb5bdc1b98c97c045bdc685171b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A859 9644 bytes
font_01_sfnt_off0005c3ca.bin
7b958e6655cb57e99f6382ded69b9a46c8455b3c9193ea641256ef052036c6fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C3CA 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.