Malicious PDF — malware analysis report

Static analysis result for SHA-256 af2dacf222ecab31…

MALICIOUS

PDF

204.6 KB Created: 2018-04-25 15:57:43 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-21
MD5: af9334962cfed4fa1f9261b31ed800c9 SHA-1: ffe0f57b166bb0c106cd4f7666fbf7655f147c59 SHA-256: af2dacf222ecab317a2c579215d81777180ce47291def551aea03b96fbe3f6e8
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7668

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%BC%D0%B0%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B5+%D0%B0%D1%80%D0%B8%D1%84%D0%BC%D0%B5%D1%82%D0%B8%D0%BA%D0%B0+%D0%B3%D0%B5%D0%BE%D0%BC%D0%B5%D1%82%D1%80%D0%B8%D1%8F+6+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%B7%D0%B0%D0%B4%D0%B0%D1%87%D0%BD%D0%B8%D0%BA PDF link annotation
    • http://renimba.info/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D0%BC%D0%B0%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B5+%D0%B0%D1%80%D0%B8%D1%84%D0%BC%D0%B5%D1%82%D0%B8%D0%BA%D0%B0+%D0%B3%D0%B5%D0%BE%D0%BC%D0%B5%D1%82%D1%80%D0%B8%D1%8F+6+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D0%B7%D0%B0%D0%B4%D0%B0%DPDF link annotation
    • https://cianahaskio1976.files.wordpress.com/2018/04/sepunubujaz-torchki-skachat-torrent-1080-pexodunofe.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907411_xupagdzpodidakticheskomumaterialu3klassliukomissarovaotvetygefeg.pdfIn PDF document text
    • https://hyapuwatchre1980.files.wordpress.com/2018/04/zitojun-optifit-zhiroszhigatel-skachat-xumefowiziku.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906886_kujesiwfizikalukashik8klassgdz1346mide.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906944_lagoguzadaniiavegepoangliiskomuiazykuwod.pdfIn PDF document text
    • https://gieskinaprnar1982.files.wordpress.com/2018/04/tokivot-aminy-anilin-konspekt-uroka-gemudeg.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907834_zekagdzpoalgebre8klassachast2zadachniknare.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906162_baxrealnyekimyporusskomuiazykuege2017sotvetamipejizad.pdfIn PDF document text
    • https://callsuptone1988.files.wordpress.com/2018/04/zojosiv-skachat-ethernet-kontroller-dlia-windows-7-64-bit-dlia-noutbuka-hp-635-tuvopotini.pdfIn PDF document text
    • https://vartoiprecfil1987.files.wordpress.com/2018/04/gapusesobiluji-gdz-po-chercheniiu-9-klass-stepakova-anisimova-2009-kepexegizasozo.pdfIn PDF document text
    • https://stanwymilynn1983.files.wordpress.com/2018/04/rufufetagep-dispersnye-sistemy-ikh-klassifikatsiia-i-primery-bonofefobumufen.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5908/5908336_doruwdemoversiiegepoliterature2015skachattugal.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906187_lalneznaikatestyegeioge2017skachatnaandroidmixod.pdfIn PDF document text
    • https://freepeginpi1984.files.wordpress.com/2018/04/falaga-besplatnye-igry-skachat-besplatno-bez-registratsii-polnaia-versiia-po-priamoi-sylke-tugop.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5907/5907254_nopimaltsevegekniga12015lumeg.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4b3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4B3 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
font_00_sfnt_off0002cf77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CF77 28844 bytes
SHA-256: f0abd033cd9136700185f1e9f379269095d8c83d1252e42e4235ab74dd35a690
font_01_sfnt_off00031085.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31085 15912 bytes
SHA-256: 6cc8eb72b1b49dc2b49057418f6e523d557859e6a3c9afd9d3e87578ffad3e98

Open this report in the interactive analyzer, or submit your own file for analysis.