Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffc8a2e718fee347…

MALICIOUS

PDF

185.9 KB Created: 2015-07-24 19:50:44 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6) First seen: 2020-09-24
MD5: f03e0daadaef3f62713fcd6d2f8d20b7 SHA-1: ad4198c81d154242d06add33ca22f837e01feeb9 SHA-256: ffc8a2e718fee347738d7c227ec04cba6f4c0044723505e77a5831ac988d806b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical alert for a malicious redirector link. The ML classifier also assigned a high probability of maliciousness. The embedded URL http://botcraftman.ru/ points to known malicious infrastructure, indicating a likely phishing or malware distribution attempt. No scripts were extracted, but the presence of a malicious link is sufficient evidence for this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7495189-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7495189-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%91%D0%B8%D0%B1%D0%BB%D0%B8%D0%BE%D1%82%D0%B5%D0%BA%D0%B8+%D0%B4%D0%BB%D1%8F+%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D1%81+3d+v13+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8 In PDF document text
    • http://fastpic.ru/In PDF document text
    • http://www.liveinternet.ru/clickIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/5//4188/4188159_signalizaciya_cenmax_super_2_way_instrukciya.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/5//4185/4185563_skachat_torrent_gta_san_andreas_dag_style.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/5//4191/4191836_fiksiki_2015_skachat_torrent.pdfIn PDF document text
    • http://www.microsoft.com/typography/fonts/In PDF document text
    • http://www.microsoft.com/typography/fonts/YouIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000243e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x243E9 3556 bytes
SHA-256: 880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281
font_01_sfnt_off0002516c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2516C 14760 bytes
SHA-256: 3b83237551df2aceac4c9154ff3cc87a2b8c075d2024920a90081c5c1a3a57c3
font_02_sfnt_off00027edb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27EDB 14516 bytes
SHA-256: 518403d12fe6ea8f4b2276f92993140583008f485a69d671e181579d911184d8
font_03_sfnt_off0002a9c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A9C0 6976 bytes
SHA-256: a80525c2e5d7aea85011a2d49f94d4ce84fc2264c7965df25c5a463033eaa468
font_04_sfnt_off0002bdf8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BDF8 6084 bytes
SHA-256: 819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3
font_05_sfnt_off0002cd8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CD8D 3752 bytes
SHA-256: 9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e

Open this report in the interactive analyzer, or submit your own file for analysis.