Malicious PDF — malware analysis report

Static analysis result for SHA-256 79397be54cd5c6f6…

MALICIOUS

PDF

198.7 KB Created: 2018-04-29 12:50:07 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-15
MD5: 74d17dd3d07563bfc0133a25fb2d9077 SHA-1: f1a88ae4f5e5fe958d7e881a22a96e48305faa7b SHA-256: 79397be54cd5c6f68bf453a618a53c2047b8a220bfd6db029f3cc007d2b132ac
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7574

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%B1%D0%B8%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D0%B8+8+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D1%84%D0%B3%D0%BE%D1%81+%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B0%D1%8F+%D1%82%D0%B5%D1%82%D1%80%D0%B0%D0%B4%D1%8C+%D0%BC%D0%B0%D1%88+%D0%B4%D1%80%D0%B0%D0%B3%D0%BE%D0%BC%D0%B8%D0%BB%D0%BE%D0%B2 PDF link annotation
    • http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%B1%D0%B8%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D0%B8+8+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D1%84%D0%B3%D0%BE%D1%81+%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B0%D1%8F+%D1%82%D0%B5%D1%82%D1%80%D0%B0%D0%B4%D1%8C+%D0%BC%D0%B0%D1%88+%D0%B4%D1%80%D0%BPDF link annotation
    • https://poporudadub.files.wordpress.com/2018/04/lowutoni-gotovye-domashnie-zadaniia-po-russkomu-iazyku-4-klass-kalenchuk-jezulunona.pdfIn PDF document text
    • https://gihukulomep.files.wordpress.com/2018/04/doxerubesimazob-teksty-s-realnogo-ege-po-russkomu-iazyku-2016-lepepiw.pdfIn PDF document text
    • https://wehivepadaja.files.wordpress.com/2018/04/ginareb-gdz-po-khimii-8-klass-2010-rudzitis-zewawixevowuxe.pdfIn PDF document text
    • https://gowodamo.files.wordpress.com/2018/04/nemuzijazogexok-zadachi-v-ege-po-khimii-wekixiriz.pdfIn PDF document text
    • https://xekojiqo.files.wordpress.com/2018/04/wisifewevi-gdz-po-russkomu-iazyku-4-klass-kanakina-rabochaia-tetrad-1-2-chast-otvety-nutag.pdfIn PDF document text
    • https://cigocopusivakohow.files.wordpress.com/2018/04/wonisa-reshebnik-po-algebre-i-matematicheskomu-analizu-10-klass-zezadaviti.pdfIn PDF document text
    • https://momuvagecisij.files.wordpress.com/2018/04/kejum-spisok-literatury-po-podgotovke-ege-po-literature-maseti.pdfIn PDF document text
    • https://nikirawewiv.files.wordpress.com/2018/04/bunojozo-voprosy-chasti-2-v-ege-po-biologii-xotalurujafunu.pdfIn PDF document text
    • https://vixoqupad.files.wordpress.com/2018/04/bujodavo-gdz-putina-russkaia-slovesnost-5-klass-reshebnik-albetkova-nujisaset.pdfIn PDF document text
    • https://fejoxupufitesivam.files.wordpress.com/2018/04/rumizu-gdz-angliiskii-6-klass-vaulina-vinonanukuge.pdfIn PDF document text
    • https://kigebomigimunopibuq.files.wordpress.com/2018/04/rurifetotowum-testy-po-matematike-ege-profilnyi-uroven-petusowedisox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4bb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4BB 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002b6d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B6D7 29268 bytes
SHA-256: c6ddc947775312616397841b1cbe3c84591b9c0fe82106f37e9e5d746c38ed38
font_01_sfnt_off0002f8b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F8B8 16064 bytes
SHA-256: ecb994bd529b3c32d214e77b4999e928172e1af94221b2fcd3ae3b74dfb98626

Open this report in the interactive analyzer, or submit your own file for analysis.