Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d33bb8dc75ec0c8…

MALICIOUS

PDF

205.3 KB Created: 2018-04-29 16:03:11 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-14
MD5: db32478e8893b600000cada5b460354e SHA-1: cd0b4396ee4512aaff1b4767cd888b491a19a758 SHA-256: 0d33bb8dc75ec0c83d6545e65bb56babfa304be537481278b2fa21183d15d232
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7000

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D1%80%D0%B5%D1%88%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA+%D0%BF%D0%BE+%D0%B0%D0%BD%D0%B3%D0%BB%D0%B8%D0%B9%D1%81%D0%BA%D0%BE%D0%BC%D1%83+10+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BC%D0%BE%D1%80%D0%B4%D0%BA%D0%BE%D0%B2%D0%B8%D1%87 PDF link annotation
    • https://folinokohusukibegab.files.wordpress.com/2018/04/zobuxedut-gdz-po-nemetskomu-7-8-klass-galskova-rabochaia-tetrad-sebaxasuv.pdfIn PDF document text
    • https://nutenikupurodejugin.files.wordpress.com/2018/04/fuzexixekagemam-primery-tem-esse-po-angliiskomu-iazyku-ege-na-temu-pitaniia-fekevuforamafe.pdfIn PDF document text
    • https://qitejucadakaquhuluv.files.wordpress.com/2018/04/fodemomexab-ege-5-klass-po-geografii-xemex.pdfIn PDF document text
    • https://qamuqajejixulolaqir.files.wordpress.com/2018/04/vavubopiboki-reshebnik-po-algebre-i-geometrii-7-klass-ershova-goloborodko-otvety-bafalizonilaze.pdfIn PDF document text
    • https://levajuhewuliji.files.wordpress.com/2018/04/mudot-skachat-besplatno-varianty-ege-2016-po-russkomu-iazyku-tsybulko-wifetonivo.pdfIn PDF document text
    • https://cogokipajuxatusit.files.wordpress.com/2018/04/zanod-senina-russkii-iazyk-podgotovka-k-ege-2017-25-variantov-skachat-vatapevojuxabu.pdfIn PDF document text
    • https://navuqoqiri.files.wordpress.com/2018/04/tedigodit-angliiskii-iazyk-gdz-10-klass-afanaseva-fukimufo.pdfIn PDF document text
    • https://xebisigi.files.wordpress.com/2018/04/fuwifopubane-ege-2016-trenirovochnyi-variant-159-soderzhanie-zadanii-sosagasevugeku.pdfIn PDF document text
    • https://behaqujawahotix.files.wordpress.com/2018/04/narodop-reshebnik-po-zanimatelnomu-russkomu-iazyku-2-klass-1-chast-mishchenkova-modizozobeniv.pdfIn PDF document text
    • https://rubepiso.files.wordpress.com/2018/04/kakiw-zadaniia-po-khimii-na-oksidy-ege-semav.pdfIn PDF document text
    • https://nutenikupurodejugin.files.wordpress.com/2018/04/fuzexixekagemam-primery-tem-esse-po-angliiskomu-iazyku-ege-na-temu-pitaniia-In PDF document text
    • https://qamuqajejixulolaqir.files.wordpress.com/2018/04/vavubopiboki-reshebnik-po-algebre-i-geometrii-7-klass-ershova-goloborodko-otvety-In PDF document text
    • https://behaqujawahotix.files.wordpress.com/2018/04/narodop-reshebnik-po-zanimatelnomu-russkomu-iazyku-2-klass-1-chast-mishchenkova-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a499.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA499 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002cd8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CD8C 30436 bytes
SHA-256: 2a38ffa2a9176988cb97d8d8da818209f763ccfe106ae05593ed522be55dc432
font_01_sfnt_off00031302.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31302 16176 bytes
SHA-256: f895a5da4b9acd375199a42282f72fcc280bfda949d9b3e5793aae32a9324da8

Open this report in the interactive analyzer, or submit your own file for analysis.