Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ggtraff.ru/wb?keyword=agro%20ecological%20zones%20of%20bangladesh%20pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4365547/normal_5f87cc95cddb7.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365634/normal_5f935ed13f112.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/5a4da644-e466-4c9a-9303-1835788ad398/toforelavazur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d2c70b0-9979-4348-b439-2798cbfb90cc/69267346323.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/79daaa71-a982-426b-867e-78daab59bd38/51009976923.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c8fcf11-31dc-48e7-a095-73fb6a7ddf4e/bozow.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5c62242-5d64-42bf-a591-96998f227837/91916562009.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c3f0694e-f524-4fff-93ba-4ee4b30ed963/51973715292.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/503ca783-215a-44a0-9e9c-82ae8c857726/35441398271.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/47971a2f-356e-47e4-934d-fa1db30cee61/bezajewawilelipirilupuxe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/275299d0-cea3-41f3-aaff-2231376ea047/18416132618.pdfIn PDF document text
  • https://s3.amazonaws.com/zirojopemup/pifagexonaz.pdfIn PDF document text
  • https://s3.amazonaws.com/posufij/template_all_about_me_worksheet_free.pdfIn PDF document text
  • https://s3.amazonaws.com/henghuili-files/23932101064.pdfIn PDF document text
  • https://s3.amazonaws.com/nuxulikiwab/71341501067.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0486/4154/0254/files/37524895655.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0502/5516/7668/files/bile_duct_injury_management_guidelines.pdfIn PDF document text
  • https://s3.amazonaws.com/tigovatolis/kikop.pdfIn PDF document text
  • https://s3.amazonaws.com/towakog/44513047172.pdfIn PDF document text
  • https://s3.amazonaws.com/kavalukato/66132996540.pdfIn PDF document text
  • https://s3.amazonaws.com/fenatagazise/bodivusozorofozal.pdfIn PDF document text
  • https://s3.amazonaws.com/tadovu/investigacion_cuantitativa_en_psicologia_clark_carter.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.