Malicious PDF — malware analysis report

Static analysis result for SHA-256 4af77f98491b88a0…

MALICIOUS

PDF

199.9 KB Created: 2018-04-28 13:58:03 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-06
MD5: 30e26e1d81d61f439a545165135ab6cc SHA-1: 5f2ca517fbb3740b273ccef6f6101922fa84574f SHA-256: 4af77f98491b88a0ac02c15e0dbd536f56e00bc2f67237b8ae08013da9362d07
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7668

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%B8%D1%81%D1%82%D0%BE%D1%80%D0%B8%D1%8F+5+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BE%D1%82%D0%B2%D0%B5%D1%82%D1%8B+%D0%BD%D0%B0+%D0%B2%D0%BE%D0%BF%D1%80%D0%BE%D1%81%D1%8B+%D0%B2+%D1%83%D1%87%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA%D0%B5+%D0%B2%D0%B8%D0%B3%D0%B0%D1%81%D0%B8%D0%BD PDF link annotation
    • http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%B8%D1%81%D1%82%D0%BE%D1%80%D0%B8%D1%8F+5+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%BE%D1%82%D0%B2%D0%B5%D1%82%D1%8B+%D0%BD%D0%B0+%D0%B2%D0%BE%D0%BF%D1%80%D0%BE%D1%81%D1%8B+%D0%B2+%D1%83%D1%87%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA%D0%B5+%D0%B2%D0%B8%D0%BPDF link annotation
    • https://img1.liveinternet.ru/images/attach/d/0//5923/5923474_tezurajhowcanyougetfreemusiconiphone6kewor.pdfIn PDF document text
    • https://carojovuwivaba.files.wordpress.com/2018/04/zitidazer-gdz-geografiia-maksakovskii-10-klass-rabochaia-vuvomudebegi.pdfIn PDF document text
    • https://ruqavuximogu.files.wordpress.com/2018/04/boxemupubat-gdz-po-matem-4-klass-rudnitskaia-rabochaia-tetrad-2-chast-zatuninaverirow.pdfIn PDF document text
    • https://vunetotunujumudokov.files.wordpress.com/2018/04/namezowojaw-otvety-po-literature-2-klassa-rabochaia-tetrad-efrosinina-kuberud.pdfIn PDF document text
    • https://xapexiqokegubuhecohi.files.wordpress.com/2018/04/vokalupokonor-vse-resheniia-ege-b7-po-matematike-gogekeguwa.pdfIn PDF document text
    • https://tibuxumaceseriri.files.wordpress.com/2018/04/sizuguwiwineb-ege-po-matematike-2012-na-9-klass-wokakakuwotifi.pdfIn PDF document text
    • https://wotidiwatunomecoq.files.wordpress.com/2018/04/tawimewe-gdz-po-angliiskomu-iazyku-9-klass-nesvit-berarani.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5913/5913854_rekaggdzrabochaiatetradpobiologii9klassprosveshchenieliwoxe.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5917/5917779_puvosiadobephotoshop2011freedownloadcs5crackxukumen.pdfIn PDF document text
    • https://dorisujuwo.files.wordpress.com/2018/04/nofuv-tablitsa-perevoda-ballov-ege-2017-po-informatike-kesepejobiwe.pdfIn PDF document text
    • https://cebapexegotu.files.wordpress.com/2018/04/gageni-reshu-oge-9-klass-russkii-iazyk-2017-testy-s-otvetami-vegejujipolakiv.pdfIn PDF document text
    • https://tibuxumaceseriri.files.wordpress.com/2018/04/gulinesudonulab-gdz-biologiia-9-klass-rabochaia-tetrad-ragasodexif.pdfIn PDF document text
    • https://vohorodiqoha.files.wordpress.com/2018/04/rarafifezimegu-reshenie-dosrochnogo-ege-po-istorii-2017-famapoxufapipid.pdfIn PDF document text
    • https://koqatafoqadi.files.wordpress.com/2018/04/rajujukepo-rezultaty-ege-literatura-2017-kogda-budut-izvestny-kojijogodu.pdfIn PDF document text
    • https://puguxugapukoculahaf.files.wordpress.com/2018/04/kemilujon-gdz-po-angliiskomu-10-klass-komarova-larionova-uchebnik-ginegixirugozu.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4b5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4B5 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002bd6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BD6A 28744 bytes
SHA-256: d587077695dc45207158feeb00251390cf01815245ef12730a7a71e4b13d5e44
font_01_sfnt_off0002fda3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FDA3 15872 bytes
SHA-256: 8524633a7182c1747d0ca9be8c78f5f888799fd9c4fb2bd3e20c226e42dcec9d

Open this report in the interactive analyzer, or submit your own file for analysis.