Malicious PDF — malware analysis report

Static analysis result for SHA-256 4870f06719cbfc0a…

MALICIOUS

PDF

43.7 KB Created: 2020-09-18 22:02:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 006c744321024a57d5ca1a10c0ad765b SHA-1: 2d910e1e83f60bd35c58b840d99db1f1655027fd SHA-256: 4870f06719cbfc0ab0ecf6623ee88c411ca7e3d1a10fbdb05119164b27ddbb9a
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to automotive parts and URLs that appear to be part of a link farm designed for SEO manipulation. This suggests the document's primary purpose is to drive traffic to malicious or spam-related websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=2001+ford+f150+4.6+transmission+fluid+type In PDF document text
    • http://files.emeraldcentre.org/uploads/1/3/1/1/131163540/rezaba.pdfIn PDF document text
    • http://files.drtangiethesexdoctor.com/uploads/1/3/1/4/131452904/xozesakofuza-rilinasirog-durinide.pdfIn PDF document text
    • http://kobon.celesteschexnaydre.com/uploads/1/3/0/9/130969895/a7e5a1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://ca2fdbb8-7063-401d-94b9-eac1811bdd4c.filesusr.com/ugd/f6336d_dcb1a462c2da40a48bbc28fa7e63aab2.pdf?index=trueIn PDF document text
    • https://6973965c-8bcc-45a7-aa03-73a88c505de7.filesusr.com/ugd/c4f63d_5d43fa07dba34db8993928b9c368ac46.pdf?index=trueIn PDF document text
    • https://cf25e517-e503-4afb-844f-077c2ec1213d.filesusr.com/ugd/b361c6_2da6effaf3564313aaa47f725c05d335.pdf?index=trueIn PDF document text
    • https://d548a872-fb9f-4c6a-a4dc-f09cceebaf2b.filesusr.com/ugd/d13e1f_c1ff968ee526451fa51110594d52cd7c.pdf?index=trueIn PDF document text
    • https://1f619619-e4ea-42fc-8bfa-2e967010b269.filesusr.com/ugd/44b221_5f4cff9eac684629bd9f18db454923e1.pdf?index=trueIn PDF document text
    • https://995d1a4b-d105-4981-86e9-645805b44f23.filesusr.com/ugd/e32576_b9d93fc02fa8459eb9e1ebbbcb9aec55.pdf?index=trueIn PDF document text
    • https://f28128a7-6976-4a70-980b-b4ab09b12de7.filesusr.com/ugd/1b9faa_96776d11cb724741a602ad57022ece47.pdf?index=trueIn PDF document text
    • https://31054477-8004-4820-a32d-5245707c1c0c.filesusr.com/ugd/7d1dc9_d40188a533aa463790223e48394e3249.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
🗂 Part of campaign: drtangiethesexdoctor.com 3 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000610c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x610C 5916 bytes
SHA-256: aacb132228a599c3ced06495c2ae2f0ed8cf30185ecc0cff98ccc2c7f234e4f1
font_01_sfnt_off00007538.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7538 14648 bytes
SHA-256: c9f0a7e50d0740733b055e8e4b6fe94947141ad16f563b43b1efd252e42541fc

Open this report in the interactive analyzer, or submit your own file for analysis.