Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3e2f9fede0f3e51…

MALICIOUS

PDF

217.5 KB Created: 2018-04-28 14:34:05 +03:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-20
MD5: 90231de874ae5520af3e71cdb1289565 SHA-1: 673193c5878c2bf6c6b594b681b0cb7b6deb80b9 SHA-256: d3e2f9fede0f3e51ca4a15fd7f57ed097a90447ad050bd79220eaa3966856b47
74 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7263

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC%D1%83+%D1%8F%D0%B7%D1%8B%D0%BA%D1%83+2+%D1%87%D0%B0%D1%81%D1%82%D1%8C+3+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B0%D1%8F+%D1%82%D0%B5%D1%82%D1%80%D0%B0%D0%B4%D1%8C+%D0%BA%D0%B0%D0%BD%D0%B0%D0%BA%D0%B8%D0%BD%D0%B0 PDF link annotation
    • http://tds.advtraff2014.ru/wp1?keyword=%D0%B3%D0%B4%D0%B7+%D0%BF%D0%BE+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%BE%D0%BC%D1%83+%D1%8F%D0%B7%D1%8B%D0%BA%D1%83+2+%D1%87%D0%B0%D1%81%D1%82%D1%8C+3+%D0%BA%D0%BB%D0%B0%D1%81%D1%81+%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B0%D1%8F+%D1%82%D0%B5%D1%82%D1%80%D0%B0%D0%B4%D1%PDF link annotation
    • https://romalifamoq.files.wordpress.com/2018/04/lipuxarij-russkii-iazyk-3-klass-buneev-buneeva-pronina-2-chast-reshebnik-gdz-gumepufobo.pdfIn PDF document text
    • https://faxusemujava.files.wordpress.com/2018/04/pominemopubiwaf-reshebnik-algebra-11-klass-kuznetsova-2008-mebofotilakabuk.pdfIn PDF document text
    • https://nipefokadojavevilo.files.wordpress.com/2018/04/muxexidazixanew-reshebnik-okruzhaiushchii-mir-3-klass-vakhrushev-rabochaia-tetrad-1-chast-2015-zuniweje.pdfIn PDF document text
    • https://wexaceqawinitejuhica.files.wordpress.com/2018/04/gutepexa-keygen-do-abbyy-finereader-8-0-professional-edition-zasuxiloso.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5918/5918718_zir1001songbookfreedownloadgabufam.pdfIn PDF document text
    • https://wotidiwatunomecoq.files.wordpress.com/2018/04/jivuko-sochinenie-na-temu-vzaimootnosheniia-cheloveka-i-prirody-ege-argumenty-rajovanaru.pdfIn PDF document text
    • https://kokeqiqejewun.files.wordpress.com/2018/04/witixol-gdz-po-istorii-5-klass-rabochaia-tetrad-maikov-otvety-1-chast-2015-zunavu.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5941/5941455_xovokadobeflashplayerdownloadkostenloschipmacpro32bittufoni.pdfIn PDF document text
    • https://malajasacajukut.files.wordpress.com/2018/04/bimit-podgotovka-k-ege-po-obshchestvoznaniiu-konstitutsiia-rf-zobepa.pdfIn PDF document text
    • https://img0.liveinternet.ru/images/attach/d/0//5906/5906232_josexogdzonlain3klasszadachijorifaj.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5911/5911056_galestendyvshkolepoegeirabovat.pdfIn PDF document text
    • https://keridijule.files.wordpress.com/2018/04/dodukotaxibaral-sbornik-zadach-po-matematike-3-klass-fgos-fewegebat.pdfIn PDF document text
    • https://img1.liveinternet.ru/images/attach/d/0//5917/5917244_kiz3gpmobileringtonesdownloadmp3free2013latestzedgenabolos.pdfIn PDF document text
    • https://busecebamapax.files.wordpress.com/2018/04/vatefus-kak-poschitat-bally-po-ege-matematika-2017-kuvovazupevanan.pdfIn PDF document text
    • https://rimucocimoj.files.wordpress.com/2018/04/kolapamomupag-gdz-po-ikt-6-klass-rabochaia-tetrad-bosova-fgos-kukepafas.pdfIn PDF document text
    • https://nipefokadojavevilo.files.wordpress.com/2018/04/muxexidazixanew-reshebnik-okruzhaiushchii-mir-3-klass-vakhrushev-rabochaia-tetrad-1-chast-2015-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000a4c1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA4C1 1485561 bytes
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585
stream_008_off0002f9ad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F9AD 31508 bytes
SHA-256: 67a10ab2bc33405d363e144654c190a38fd5e6eacc05834240fc81fe98d8d0b5
font_01_sfnt_off000342a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x342A7 16180 bytes
SHA-256: ecd6f9012a9a1776294cbeee847fcd727e318af24634fd53d75ce99ec4a6408e

Open this report in the interactive analyzer, or submit your own file for analysis.