MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file contains an embedded link identified as a known malicious redirector. This indicates the document is likely part of a phishing or malware distribution campaign. The link points to http://botcraftman.ru/, which is flagged for malicious activity. No scripts were extracted, and the document body was unreadable.
Heuristics 2
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://botcraftman.ru/?lip&keyword=%D1%82%D1%80%D0%B8+%D0%B1%D0%BE%D0%B3%D0%B0%D1%82%D1%8B%D1%80%D1%8F+%D0%B8+%D0%BC%D0%B0%D1%80%D0%B8%D0%BE+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8
- http://img0.liveinternet.ru/images/attach/c/7//4816/4816375_solas__na_.pdf
- http://img1.liveinternet.ru/images/attach/c/7//4811/4811112_skachat__albom__yelektro_.pdf
- http://img1.liveinternet.ru/images/attach/c/7//4815/4815360_skachat__gotovuyy__server_.pdf
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00052663.bin795bd9716541863038ece1494f91e60d2812d856a293438fce7ba8ceea65ebf0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x52663 | 7936 bytes |
font_01_sfnt_off00053d64.bin2aa37113df08a121c1c893b4493e7edb135a0fc25284a81afc602a803ef52e45 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x53D64 | 15076 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.