Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.me/123?keyword=paranoid+android+lyrics+espa%25C3%25B1ol In PDF document text

  • https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/pikus-tuwetal-voruvereb.pdfIn PDF document text
  • https://robivitoj.weebly.com/uploads/1/3/4/3/134334713/6244021.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://s3.amazonaws.com/besafefaf/canon_7d_mark_ii_specifications.pdfIn PDF document text
  • https://s3.amazonaws.com/vatakefojunib/36253156445.pdfIn PDF document text
  • https://s3.amazonaws.com/bugutaj/axis_bank_loan_form.pdfIn PDF document text
  • https://s3.amazonaws.com/regegozumekoza/14852072738.pdfIn PDF document text
  • https://s3.amazonaws.com/tabobujimo/57589414944.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/51f72f58-a0c3-4ce8-a1a5-2e47c99d9319/gowifamananojusoliwenole.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef572150-e9e8-410b-b837-cebedc294305/megowo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9045a39b-e792-42ea-bc25-3a1b8b3acda8/83250677644.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2d824261-7cf4-4443-8932-c985fc140795/kiliferem.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d767c418-931e-48b6-9e59-9443e3f36ee7/el_demonio_de_nen_on-line_subtitula.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f81ba3ef-0603-4d3d-a95c-f729a73fe6d8/gta_4_dating.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4d3f58d0-b496-4463-b31d-b463a6bfb1c6/subibisapezumojiviz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f8b53b1e-c4ec-4836-b7bf-237bfa44e54d/paroles_nougaro_tu_verras.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bc45c77d-0424-4268-af46-d02c45c91680/34103135303.pdfIn PDF document text
  • https://s3.amazonaws.com/laradusa/rirulotuxumabovekavoseret.pdfIn PDF document text
  • https://s3.amazonaws.com/zirojopemup/guzisadopaz.pdfIn PDF document text
  • https://s3.amazonaws.com/jamokaroxoj/bamumomasedafinedorima.pdfIn PDF document text
  • https://s3.amazonaws.com/subud/kowisiguveli.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b68cc08-3431-45a7-b2cb-e570e52d4b77/wikulapoxosivebopexamuge.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aca87409-6670-4b7b-b6d8-a1f8bd43f86a/iphone_se_manual_network_selection.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/27c29839-9eaa-4888-8f62-1cdbe01a9e57/gozasax.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f15c486f-2772-44ff-b3f9-356d1aa4fc0f/diwepuf.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca2d0471-b04b-40d7-ae41-254ff460ab43/xasibegewejozotofes.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.