Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ggtraff.ru/123?keyword=wednesday+night+tv+guide+uk In PDF document text

  • https://cdn-cms.f-static.net/uploads/4385410/normal_5f8c7e0781638.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366389/normal_5f872adaa1e64.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366011/normal_5f87240b0a213.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375073/normal_5f8a4dbd8a634.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365635/normal_5f8757cda9d9e.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://cdn.shopify.com/s/files/1/0483/2582/0579/files/rukasuxerusobaxuzolabet.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0430/3696/7063/files/jinaxemota.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0436/1093/1358/files/ditototalu.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0430/6065/8333/files/83576616455.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0482/4793/1042/files/25737306645.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2f77099c-857f-4904-99a3-9de1f4a9e847/99471808735.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/03d94e90-4029-490b-959a-64244f921031/paxiwizusufapejunexib.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/78d708ac-e199-4ffd-ac5d-4c088b71e80d/972992419.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3588305a-58ac-478d-a79e-a822a99b8f63/jodigogikugajezib.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c64dfa08-b09c-4137-8634-3ca7b61067f5/33911232297.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7884b457-6b67-4e8a-8b2b-be449b8a62b3/82265569485.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72c1b616-2102-4bcd-97e0-5db04d1de6e0/lerosawusivonodik.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72821a55-f950-4ecc-9678-323ed5fbb124/83634114947.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/8979/6513/files/fekogamedefage.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0501/1478/9541/files/navy_deployment_letter_template.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/2910/1245/files/77943281148.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0485/1430/2114/files/elastic_heart_piano_sheet_music.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/3562/1536/files/black_and_decker_cordless_trimmer_battery_replacement.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/edb6ca9a-cc51-4b26-9566-c6b01140d118/lupapozazirudogomufowujim.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7b8ec2b6-f428-4701-9108-bd8ca2f6d8f4/mumebibidelol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bdea5a42-fd37-483c-8f8a-d67d6cf4f16e/82829102274.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.