Malicious PDF — malware analysis report

Static analysis result for SHA-256 7174f1d59eb51483…

MALICIOUS

PDF

41.4 KB Created: 2020-09-19 00:20:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 0b1b1cd083fee98dc0d50492c5a7d36a SHA-1: 19f3d273ab0ea20311d60c858d03c7cba7668a7f SHA-256: 7174f1d59eb51483c1d8e73e2174e8a0c4a204f4668c75c6a38089ac503847df
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, many of which point to disposable hosting or redirector services, indicating a link farm designed to lure users to malicious sites. One critical heuristic identified a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text suggesting it is an answer key, a common lure for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=myspanishlab+sam+answer+key+chapter+4 In PDF document text
    • http://files.samanthastewartofficial.com/uploads/1/3/0/9/130969440/xarisug.pdfIn PDF document text
    • http://files.blsst.co.nz/uploads/1/3/1/3/131380666/vujegumupi_zogatus.pdfIn PDF document text
    • http://files.body-knowledge.com/uploads/1/3/0/7/130775823/1119226.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://386629e5-56dc-4195-a0dd-390656cd9a88.filesusr.com/ugd/b98abb_adbae0d7d28a46a78dceec922efd2c86.pdf?index=trueIn PDF document text
    • https://d29cec17-db94-4ca6-914d-bd432785b294.filesusr.com/ugd/808cd0_f3cde06159f14cf980afa709293aa106.pdf?index=trueIn PDF document text
    • https://d314901b-3d20-441f-b926-8d43da746600.filesusr.com/ugd/cbe7f7_0107da1e26554a6dba9cac71088f0326.pdf?index=trueIn PDF document text
    • https://cfebf1bb-8823-4cb1-a337-667486bc5789.filesusr.com/ugd/91e123_246cf552f88047ec91c1717db7750f4f.pdf?index=trueIn PDF document text
    • https://8cfc8560-1948-446c-b958-4e5b624fad1b.filesusr.com/ugd/d2cc1f_bc368fa1a8b04eb8b50dea133ea54295.pdf?index=trueIn PDF document text
    • https://dba93531-05d5-498d-8ed9-a7bcb5bda46a.filesusr.com/ugd/cb5dea_aa2c276c9ba34ed9954430ab1d300784.pdf?index=trueIn PDF document text
    • https://de1f7f45-7f2d-4d9c-a549-2ab8f4c91d29.filesusr.com/ugd/681527_e841f289efdb467589722195c14d50b3.pdf?index=trueIn PDF document text
    • https://293695f5-1b47-4a60-b2a6-028130baf4aa.filesusr.com/ugd/c2bf0a_ea5bba28941c466da59158409d609e76.pdf?index=trueIn PDF document text
    • https://dafbb76f-da14-46b9-9467-1397d60d6fd4.filesusr.com/ugd/c068f8_d2521c5e33624d21adddd8fa5fe526f9.pdf?index=trueIn PDF document text
    • https://f4024130-18bd-48df-b47d-5f7f9e77e248.filesusr.com/ugd/83b1b3_a28595ad70764336927fb0e61ba87ad8.pdf?index=trueIn PDF document text
    • https://d23ed075-e30f-4073-ab47-63a2dc1b512d.filesusr.com/ugd/592671_385548dcfc0249119e3eedd8b529787e.pdf?index=trueIn PDF document text
    • https://66edfb54-2038-48d1-9b87-b4d9d609f3e3.filesusr.com/ugd/c4f63d_012f279dc1d04cd59e2278fec9d1153b.pdf?index=trueIn PDF document text
    • https://d215d8b0-f2f9-41f3-9e48-884f927709d3.filesusr.com/ugd/a7074a_4aae736455ce48b2956c5a56bf8b498d.pdf?index=trueIn PDF document text
    • https://6cf7c580-64ac-475c-b857-05802f86525d.filesusr.com/ugd/59deca_8e9a0473954c4134b56950068664ae69.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54F4 5344 bytes
SHA-256: a85ca9ada0be78fae10e4f97e9c8aa677eece4e330599ba0f655b7e22cd9926e
font_01_sfnt_off00006702.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6702 10296 bytes
SHA-256: b4e8d49e6e629944eb95f0f28245cdef7c926dcb062707bd4a0503e9517b201e
font_02_sfnt_off00008a16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A16 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.