Malicious PDF — malware analysis report

Static analysis result for SHA-256 147c52d442bf1016…

MALICIOUS

PDF

354.2 KB Created: 2015-11-29 07:53:56 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 83ed71432253cee1d8382de52f862e83 SHA-1: 18e88d6e03906fa8d4ab8b38dae40d94427eb20f SHA-256: 147c52d442bf1016f9288c97f956049a1ee7d4ffdd731c3aa3b01de591e71b19
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a high-confidence heuristic indicating it is a lure for SEO redirectors, specifically a 'free-download phishing' attempt. The embedded URL points to a domain that appears to be a redirector, likely serving as a malicious landing page or download source. No scripts were extracted, but the PDF structure and URL suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9897

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://taurus-tg.ru/?nnr&keyword=effective+java+2nd+edition+%D0%BD%D0%B0+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8 PDF link annotation
    • http://media.nn.ru/data/ufiles/2015-11/cd/7e/81/5659d845df179_draiverdliainternetkontrollerawindows7.pdfIn PDF document text
    • http://media.nn.ru/data/ufiles/2015-11/a5/b9/b1/5659ca5c28dc9_tachkimultachkibaikimetraigraskachattorrent.pdfIn PDF document text
    • http://media.nn.ru/data/ufiles/2015-11/a3/82/5b/564806c421ff5_tematicheskietestyporusskomuiazyku8klassmaltsevaotvety.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005406b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5406B 9224 bytes
SHA-256: 17e05ac6daf8b4dece97c86551c9ecca53fb31391b581009d848e4dddf17e2cd
font_01_sfnt_off00055987.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55987 15704 bytes
SHA-256: 393e9e9ce0e91d5653d024c58704e2e1a0a59ccee9bd803a09102fe7c30e6753

Open this report in the interactive analyzer, or submit your own file for analysis.