Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd77f43ee70cc468…

MALICIOUS

PDF

212.7 KB Created: 2018-04-28 14:42:31 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-18
MD5: cd3cc713c26bc9b4b838b37008090572 SHA-1: a17dcdad212ef5ddeb0b7f68f94a78e952fc6388 SHA-256: cd77f43ee70cc468edeb44f2d3d2a745837744387a9ec439b5019c3cd927da9c
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7263

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D0%BF%D1%80%D0%BE%D1%85%D0%BE%D0%B4%D0%BD%D0%BE%D0%B9+%D0%B1%D0%B0%D0%BB%D0%BB+%D0%BF%D0%BE+%D0%B5%D0%B3%D1%8D+2016+%D1%84%D0%B8%D0%B7%D0%B8%D0%BA%D0%B0 PDF link annotation
    • https://diqevidoduqupesaxef.files.wordpress.com/2018/04/gawevafit-kogda-budet-ege-po-fizike-v-2016-godu-derufi.pdfIn PDF document text
    • https://rimucocimoj.files.wordpress.com/2018/04/nemuju-gdz-po-angliiskomu-iazyku-biboletova-11-klass-uchebnik-newogedikufipa.pdfIn PDF document text
    • https://jokomexuvicocari.files.wordpress.com/2018/04/zuxev-gdz-po-fizike-10-klass-miakishev-skachat-besplatno-pdf-kafij.pdfIn PDF document text
    • https://taketirofupisuxejegi.files.wordpress.com/2018/04/zujowijugedu-gdz-kontrolnaia-rabota-po-algebre-8-klass-merzliak-tukupafunowivod.pdfIn PDF document text
    • https://rimucocimoj.files.wordpress.com/2018/04/dupirezo-gdz-khimiia-11-gabrielian-piximakutebusa.pdfIn PDF document text
    • https://muvunesijej.files.wordpress.com/2018/04/pipulogubipe-bally-po-russkomu-iazyku-ege-2017-kak-schitat-po-zadaniiam-zuxikevogon.pdfIn PDF document text
    • https://diqolahesa.files.wordpress.com/2018/04/nokalibi-gdz-po-algebre-7-klass-a-g-mordkovicha-torit.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5930/5930843_kurezofirefoxlinkinneuemtaboffnenshortcutkobew.pdfIn PDF document text
    • https://mitagaxucijide.files.wordpress.com/2018/04/kobipode-problema-pamiati-argumenty-ege-tasoxodima.pdfIn PDF document text
    • https://cigocopusivakohow.files.wordpress.com/2018/04/xapevumidoneke-diagnosticheskie-raboty-po-matematike-11-klass-v-forme-ege-2017-dabisapik.pdfIn PDF document text
    • https://pafihugomevare.files.wordpress.com/2018/04/gifazobejowet-gdz-po-fizike-7-klass-purysheva-rabochaia-tetrad-xodopudexivonu.pdfIn PDF document text
    • https://cigocopusivakohow.files.wordpress.com/2018/04/lujujofenu-etika-gdz-4-klass-badulolepuni.pdfIn PDF document text
    • https://gupidesu.files.wordpress.com/2018/04/xujuletoz-gdz-posobie-po-angliiskomu-iazyku-dlia-meditsinskikh-uchilishch-tylkina-gdz-misomitave.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5940/5940600_sibomoddownloadgamegodofwar2forpc100workingmulib.pdfIn PDF document text
    • https://meqabevineke.files.wordpress.com/2018/04/nekuze-gdz-po-istorii-7-klass-foguxisawakiwob.pdfIn PDF document text
    • https://cigocopusivakohow.files.wordpress.com/2018/04/xapevumidoneke-diagnosticheskie-raboty-po-matematike-11-klass-v-forme-ege-2017-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a487.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA487 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
stream_008_off0002df51.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2DF51 34624 bytes
SHA-256: 53a7f5a8c7cf212498df20eefcab07f24252bea26611b12d0655279b01b852cd
font_01_sfnt_off000330a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x330A0 15784 bytes
SHA-256: 34291179537890eefcfb7d64f793a39d97bcb19c9e5c5776a973950b14faf0b3

Open this report in the interactive analyzer, or submit your own file for analysis.