Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.me/wix?keyword=national+treasure+2+movie+questions+worksheet+answers In PDF document text

  • http://dizolas.heilandconsultingllc.com/uploads/1/3/0/9/130969260/f6328e5b437.pdfIn PDF document text
  • http://mijumuko.quabelle.com/uploads/1/3/1/1/131163658/6666700.pdfIn PDF document text
  • http://monulolu.capturethestarsworkshops.com/uploads/1/3/1/4/131438707/vuwenufi.pdfIn PDF document text
  • http://gesuli.rescueber.org/uploads/1/3/0/8/130874067/d10eaa157b2d.pdfIn PDF document text
  • http://files.flipconsultants.com/uploads/1/3/0/7/130740586/6921591.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://c3e51e88-9000-42b1-b434-a382b0c888b4.filesusr.com/ugd/b85eb0_f4fdbd06a4754d7da7560964bd0369f8.pdf?index=trueIn PDF document text
  • https://20d649de-1878-4614-8314-b0f47948c347.filesusr.com/ugd/185c00_53ad08841473445e8f01ca955e14eff4.pdf?index=trueIn PDF document text
  • https://848923e5-7cbf-4b7f-97b7-29de10531cc4.filesusr.com/ugd/d8966e_ed2c4c40e4df4ecfbb74f3bb3886e310.pdf?index=trueIn PDF document text
  • https://07a041f0-bc4f-4f67-8da7-574ee435ee01.filesusr.com/ugd/9b7d8a_eac3cd5c0e9942588ffdc920764a0326.pdf?index=trueIn PDF document text
  • https://db5db6b8-609c-423d-bda1-4b53ca235325.filesusr.com/ugd/12f4eb_305f72b172a34c309d7d67b81d4dd234.pdf?index=trueIn PDF document text
  • https://bdf0783f-338f-45e6-b95d-bbc51db2d407.filesusr.com/ugd/bcb9fd_182081031d834113b8be43a697266b16.pdf?index=trueIn PDF document text
  • https://ce7b6752-2cdc-4fcd-8e71-d2163a3b2706.filesusr.com/ugd/c2007e_fc7543e6e501499bbd0b511752c80b47.pdf?index=trueIn PDF document text
  • https://35021c17-498c-40b3-8378-884a0c48d0e7.filesusr.com/ugd/d5415a_181a3dc825ee4767a30af53b0636c5d0.pdf?index=trueIn PDF document text
  • https://6647f1ba-e35c-441a-a0f4-2d0dfa94a043.filesusr.com/ugd/1f5cef_b611123dca9749d9b3a859dd440be12d.pdf?index=trueIn PDF document text
  • https://aa86fbeb-1c33-44fa-8125-578b229203a7.filesusr.com/ugd/cf9ff1_8000751d707e451b9463c4ea2502dabe.pdf?index=trueIn PDF document text
  • https://d1c733c8-d417-4cf7-9cca-2357cfc6ff35.filesusr.com/ugd/4c76bf_702a9f6ab9154bfcb147602af8c0ea9c.pdf?index=trueIn PDF document text
  • https://32a38f7a-7d95-45c9-927c-de0c421825c7.filesusr.com/ugd/87d215_b1eafb127992465e9b6568b43196bf6e.pdf?index=trueIn PDF document text
  • https://db2269fa-2223-4ec1-bb0e-265556e93361.filesusr.com/ugd/95bb70_72a04d84d7a84cb1ad746d141de40f2b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.