Malicious PDF — malware analysis report

Static analysis result for SHA-256 425f1058de1dfbd6…

MALICIOUS

PDF

196.6 KB Created: 2018-04-29 12:53:23 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-15
MD5: 8fb7c01fbe4cc66f2d1a6b546d570e07 SHA-1: 78e68faf47cf611a51277a9d95d2efe6f8d4465e SHA-256: 425f1058de1dfbd638c87d2263749ec2d4c3053ed971c1848ca526f7e8d1adcb
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6516

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D1%80%D0%B5%D1%88%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA+%D0%BF%D0%BE+%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC%D1%83+%D1%8F%D0%B7%D1%8B%D0%BA%D1%83+4+%D0%BA%D0%BB%D0%B0%D1%81%D1%81 PDF link annotation
    • https://pewusogafadac.files.wordpress.com/2018/04/sumotekemit-zadaniia-po-geometrii-ege-2016-profilnyi-uroven-taxalutalajuje.pdfIn PDF document text
    • https://vixoqupad.files.wordpress.com/2018/04/dajidewisutos-omsk-rezultaty-oge-po-kodu-2017-omsk-relarunopulazag.pdfIn PDF document text
    • https://nowohexi.files.wordpress.com/2018/04/tisiv-gdz-po-khimiia-7-klass-gabrielian-gasogelugisewu.pdfIn PDF document text
    • https://gurocorewavepetivequ.files.wordpress.com/2018/04/noresotezirim-rezultaty-ege-v-dagestane-2015-po-matematike-ziwolod.pdfIn PDF document text
    • https://romalifamoq.files.wordpress.com/2018/04/vobitoje-kalkuliator-ege-2017-perevod-pervichnykh-ballov-rabogiz.pdfIn PDF document text
    • https://hoxugiroperarucev.files.wordpress.com/2018/04/varumeg-gdz-po-nemetskomu-iazyku-10-klass-bim-lytaeva-sadomova-patusapevijuru.pdfIn PDF document text
    • https://nipefokadojavevilo.files.wordpress.com/2018/04/fibekaduleb-ustnaia-chast-ege-po-nemetskomu-primery-gonawel.pdfIn PDF document text
    • https://gutagoxelivafekida.files.wordpress.com/2018/04/zudemofop-sbornik-zadach-po-fizike-peryshkin-gdz-skachat-loliliditip.pdfIn PDF document text
    • https://gihukulomep.files.wordpress.com/2018/04/nupet-fizika-ege-s-nulia-rusudowob.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a497.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA497 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002b7d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B7D1 26220 bytes
SHA-256: 5298a271ed4e4cdf44e57ae14b59a5165e152e857e8ba939de1df3ad8f7b84a3
font_01_sfnt_off0002f1bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F1BC 15700 bytes
SHA-256: a021dd9ab1da8bfc77d804325d5f8f0286f150725250986975eeea5f77923148

Open this report in the interactive analyzer, or submit your own file for analysis.