Malicious PDF — malware analysis report

Heuristics 6

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/123?keyword=production+planner+resume+pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4365563/normal_5f9575386e56f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4379720/normal_5f9286f235967.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4391327/normal_5f95f082c4975.pdfIn PDF document text
  • https://buveziketi.weebly.com/uploads/1/3/1/3/131398526/9be49eb89d1b10.pdfIn PDF document text
  • https://dokakida.weebly.com/uploads/1/3/1/3/131380589/kaposixubu.pdfIn PDF document text
  • https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/3079835.pdfIn PDF document text
  • https://jixepelisu.weebly.com/uploads/1/3/2/6/132695865/lavos_bukisamawipa_sutobilojunevod.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00007288.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00007288.bin)
  • http://www.daltonmaag.com/In extracted file (font_02_sfnt_off0000a813.bin)
  • https://cdn.shopify.com/s/files/1/0429/8306/3715/files/83275928582.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0482/0130/2168/files/smartphone_tycoon_2_hack_apk_download.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0429/3741/7887/files/37733721124.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ccacb954-b109-4bcc-b297-2ff312af2e1d/moderegufexe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d94ea28c-7a12-4c34-88f4-10d5464bbe4c/96597555289.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6651a518-cf90-4d98-8abc-ce67a415e133/16667083812.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/83db9540-3584-44ab-a5e8-194db9f0b19d/dewavanamup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/13a8e998-46b6-40bb-a986-66176e2a0782/5784695460.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f22abe0-c52c-4a6a-a662-480cb48cf6b4/76239206165.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/de3772ac-2e92-4488-ae97-3b52aeb84532/41504655793.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/81fbe7fe-82c1-41de-b692-3cf9f4d04dd7/54893920628.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f25d5a9e-570e-4343-821d-7f7e444b821d/64163258240.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/011c9bf3-ce07-4dee-91cd-74117388a300/13183072592.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7cedba9b-15f0-43e2-be7a-0d771437d09c/tezubagitegekariw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c107f324-84d7-4c0e-86b9-3fd4eab2bd06/frases_de_carl_rogers_tornar-se_pessoa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/83f07d5c-6ec2-4313-b557-1a668804062c/balsa_wood_airplane_plans_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61d90a3b-4187-4275-a088-9e53f6fc9c17/78359709777.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00007288.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.