Malicious PDF — malware analysis report

Static analysis result for SHA-256 941d3ebca194728f…

MALICIOUS

PDF

210.6 KB Created: 2018-04-28 13:26:35 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-12
MD5: 2b0e780faa6965a61bfe750d7013fa4c SHA-1: 30a52901c2c6d034e72bfaa20465a0debd8964de SHA-256: 941d3ebca194728f0ec0af21328841284fa8eb96b089b2a04abd40f25594b284
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8002

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D1%80%D0%B5%D1%88%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA+%D0%BF%D0%BE+%D0%BC%D0%B0%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B5+%D0%B5%D0%B3%D1%8D+2017+%D0%BB%D1%8B%D1%81%D0%B5%D0%BD%D0%BA%D0%BE+40+%D0%B2%D0%B0%D1%80%D0%B8%D0%B0%D0%BD%D1%82%D0%BE%D0%B2+%D0%BE%D1%82%D0%B2%D0%B5%D1%82%D1%8B+%D1%81+%D1%80%D0%B5%D1%88%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC PDF link annotation
    • http://tds.advtraff2014.ru/wp1?keyword=%D1%80%D0%B5%D1%88%D0%B5%D0%B1%D0%BD%D0%B8%D0%BA+%D0%BF%D0%BE+%D0%BC%D0%B0%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B5+%D0%B5%D0%B3%D1%8D+2017+%D0%BB%D1%8B%D1%81%D0%B5%D0%BD%D0%BA%D0%BE+40+%D0%B2%D0%B0%D1%80%D0%B8%D0%B0%D0%BD%D1%82%D0%BE%D0%B2+%D0%BE%D1%82%PDF link annotation
    • https://carojovuwivaba.files.wordpress.com/2018/04/devogejakimabe-ege-matematika-profil-bally-po-zadaniiam-jexiginepix.pdfIn PDF document text
    • https://bitinesatawuqime.files.wordpress.com/2018/04/vasituruwudi-gdz-po-geografii-8-klass-rabochaia-tetrad-e-v-kim-2015-tinunotive.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5920/5920914_lod300riseofanempirefullmovieinhindifreedownloadmp4pefup.pdfIn PDF document text
    • https://xafuqaniqehigib.files.wordpress.com/2018/04/lifegakem-gdz-po-russkomu-iazyku-8-klass-fgos-lvov-lvova-mobujege.pdfIn PDF document text
    • https://kokeqiqejewun.files.wordpress.com/2018/04/rotomowawoga-gdz-po-okruzhaiushchemu-miru-4-klass-o-n-fedotova-rabochaia-tetrad-lalonesatiba.pdfIn PDF document text
    • https://momuvagecisij.files.wordpress.com/2018/04/sesotin-algoritm-napisaniia-sochineniia-v-11-klasse-na-ege-bodudoxu.pdfIn PDF document text
    • https://xefasigituwohohen.files.wordpress.com/2018/04/kexerazakipinu-rezultaty-oge-po-ikt-2017-xiwuxemesokub.pdfIn PDF document text
    • https://peqawomesosew.files.wordpress.com/2018/04/kogadamesobazap-gdz-literatura-6-klass-soloviova-femapab.pdfIn PDF document text
    • https://rimucocimoj.files.wordpress.com/2018/04/resepusaruta-gdz-po-fizike-uprazhnenie-7-pioryshkin-fuzezavox.pdfIn PDF document text
    • https://josexunutegevibi.files.wordpress.com/2018/04/fekusediselulo-matematika-uchebnik-5-klass-chitat-gimuleto.pdfIn PDF document text
    • https://kugadicusevasejujek.files.wordpress.com/2018/04/jubifekejin-angliiskii-rabochaia-tetrad-8-klass-komarova-gdz-mivesemikejud.pdfIn PDF document text
    • https://jimorebo.files.wordpress.com/2018/04/veduvija-matematika-gdz-5-klass-rudnitskaia-rabochaia-tetrad-2-chast-lusiwuvek.pdfIn PDF document text
    • https://cigocopusivakohow.files.wordpress.com/2018/04/diruxejofiwu-reshebnik-matematika-6-klass-merzliak-polonskii-iakir-fgos-gdz-ot-putina-jofivotegaje.pdfIn PDF document text
    • https://janerapatopisolino.files.wordpress.com/2018/04/raxurepozij-gdz-po-ritorike-7-klass-ladyzhenskaia-uchebnik-gdz-lulexutinuwe.pdfIn PDF document text
    • https://rubepiso.files.wordpress.com/2018/04/padotuzamez-reshebnik-po-geometrii-7-9-klass-atanasian-466-dugifolaferekef.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4d1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4D1 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002e1fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E1FA 30916 bytes
SHA-256: 3ce17ccdc83660370750ca142fa1f9ab770d72b05be6228e560b42fb77fd9453
font_01_sfnt_off000327cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x327CF 16064 bytes
SHA-256: 56d55165e4c94071a282ace962a63e4578c0bd595b970f6c799d642e9a0465bc

Open this report in the interactive analyzer, or submit your own file for analysis.