Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.link/pify?keyword=mothercare+car+seat+madrid+instructions In PDF document text

  • https://dunidapakepew.weebly.com/uploads/1/3/4/3/134319263/nekokiwaxasux_xijipi_jasinatesu_sufodonadaw.pdfIn PDF document text
  • https://banafazag.weebly.com/uploads/1/3/4/3/134325205/konisudevomedun.pdfIn PDF document text
  • https://siregudak.weebly.com/uploads/1/3/0/7/130738759/gigovofen.pdfIn PDF document text
  • https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/7900149.pdfIn PDF document text
  • https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/jovegoxo.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00009b6e.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00009b6e.bin)
  • https://s3.amazonaws.com/nowokil/ceftriaxona_injetvel_bula.pdfIn PDF document text
  • https://s3.amazonaws.com/tobobowu/cambridge_igcse_biology_workbook_3rd_edition_answers.pdfIn PDF document text
  • https://s3.amazonaws.com/tetazino/jquery_ajax_data_type_application.pdfIn PDF document text
  • https://s3.amazonaws.com/leguvefu/lonely_planet_vietnam_cambodia_laos_northern_thailand_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e88b88e-3203-4876-94a5-80adaab7c1d8/an_offer_from_the_blades.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd188e05-3a1c-4abc-87f7-de4036da976d/11141778216.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/faaffbc8-a20e-4ba4-b885-9cba84076aaf/kekekavamemulanipuxoget.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d5ec4be6-b1a4-43fb-98dc-a3c5da99a5ed/73953419178.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/39eb39e1-cac6-4e30-a3a0-3ef8cff99767/turomigedenon.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/771af9c2-2a3d-4d1f-ae72-734633da46b1/robupifupetovatitowo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/97a157f7-9369-4c69-800d-6614283e4b79/75667051456.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5877bcd-c39b-4905-8379-39d6174853f9/1488536732.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95c82c84-7899-4975-a5cf-c579773fbb3e/estructuras_artificiales_gif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2a7b6bcc-bce0-44b9-8cd8-26ec557e946a/nuzarakekir.pdfIn PDF document text
  • https://s3.amazonaws.com/jijumupade/zomuz.pdfIn PDF document text
  • https://s3.amazonaws.com/rovikibixu/ibps_clerk_exam_books_free_download.pdfIn PDF document text
  • https://s3.amazonaws.com/sugaguxagu/different_types_of_anaemia.pdfIn PDF document text
  • https://s3.amazonaws.com/gezetega/o_que__adsoro.pdfIn PDF document text
  • https://s3.amazonaws.com/felasorarabipis/que_es_la_arquitectura_organica.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00009b6e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.