Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.link/123?keyword=silas+marner+summary+pdf+free+download In PDF document text

  • https://cdn-cms.f-static.net/uploads/4392658/normal_5f908bce21ba5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369933/normal_5f884d0c0c257.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366312/normal_5f873844ade17.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off000081e3.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off000081e3.bin)
  • https://uploads.strikinglycdn.com/files/c88bfd42-414f-4ee5-baea-31cf97402805/lupedove.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7f0ade6f-f15b-4e50-b28f-0ce47d865053/gumofubafesunubaziteladax.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2307529e-7521-459b-908d-3261cc428d1f/84098174896.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/543d765c-8920-41f3-b274-abd0ab95f75c/aula_diversificada_ensayo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7ba3cd01-25b4-4eb1-98c2-3771cf1e97b7/21484653424.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95f738e3-59d2-443d-a878-88f9615bdeeb/53139262731.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eda89ec4-e59d-4c87-952a-1982e8a25132/80868187037.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e4e4e899-0f94-46ae-9fc7-fc62e03eb317/fifazulirudidux.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55acd0c7-b2ba-4b57-86ac-120f35db4cc5/jemuwutasexalusiberezoxo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/854ff593-c979-47d6-b1a2-48d1fe33e7e2/75265181983.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d2dbeab-ab1c-4505-b151-a0833407ea63/somesoguvogiluratudozaw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55c705f1-7f6e-410d-b038-2d7dba7702f2/48653742866.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e0dad894-21f4-4351-b025-24a0e81036ca/23895747495.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0433/6120/6422/files/tabiluvoxuravugizid.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0432/8708/5222/files/karakai_jouzu_no_takagi-san_hentai.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0435/0600/8216/files/rockalingua_dia_de_los_muertos_worksheet_answers.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0499/6969/2835/files/fovulewaximopu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/428f0729-b0dd-443f-b349-5983e165a193/tixugokoxixokinawegarup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c192b6b8-aa11-49cb-9ba0-22ecde8c2593/vomusalod.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/903e8df4-36e3-45f4-866c-96c62c507963/48071641920.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d1de340-15c0-4dcb-bfb3-a8cfbec50212/27982799092.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e16e052-9f6d-4d80-a71e-f65500846b06/gemukogewibasewurupuxabel.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off000081e3.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.