Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ggtraff.ru/123?keyword=alexander+the+great+pdf+free+download In PDF document text

  • https://s3.amazonaws.com/megodipewukitoj/gozun.pdfIn PDF document text
  • https://s3.amazonaws.com/nisoxow/cabildo_significado.pdfIn PDF document text
  • https://s3.amazonaws.com/gotijejaj/79083426098.pdfIn PDF document text
  • https://s3.amazonaws.com/kakekojezutok/86814171010.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376359/normal_5f93bfeb3978d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366047/normal_5f8897e1543ee.pdfIn PDF document text
  • https://s3.amazonaws.com/bewibiwat/acid_bases_and_salts_class_10_ncert_solutions.pdfIn PDF document text
  • https://s3.amazonaws.com/memul/ruwemopebodekijegisuk.pdfIn PDF document text
  • https://s3.amazonaws.com/zuguvoxoki/stretching_exercises_for_lateral_epicondylitis.pdfIn PDF document text
  • https://s3.amazonaws.com/jezaxojipevu/advances_in_materials_science_and_engineering.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00007461.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00007461.bin)
  • http://www.daltonmaag.com/In extracted file (font_02_sfnt_off0000a9d0.bin)
  • https://uploads.strikinglycdn.com/files/15bc6094-e125-45fd-b8d2-a65515ab1085/23007243421.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5ec2b63-962a-4446-8f70-8c36fc7ff073/kigaluvogisinivusikuto.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e07df57b-4c1c-4653-9d6b-fde7c4a7b91a/vogodovegeko.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/13fee89d-d15a-480e-801d-994951b4c8ad/86799166627.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4ff9bdff-31d1-474c-8e9b-724876465376/darkest_dungeon_shieldbreaker_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f84db408-b77e-4019-bc05-060051e965ad/siferofimuduguzez.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1be49e11-c677-40ad-8caa-d7093e4cd719/lejavofanuboseroxidusufu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/49805d6a-c839-4fd4-880f-557d1981ea3d/73625796168.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4dd607d2-a0d3-449f-b293-3367bc0a8f39/84368255265.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a55bc663-78c1-49b5-8791-b8cb3f160e59/boxilovipit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ebf75ea2-0b4f-4994-b548-a93b0b81030a/litotes_definition_literature.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea1cdc52-9ad1-4d62-9757-37e52f506b9c/lomujikubuwik.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b0ef9f31-0b98-4708-9beb-b07ee3dceaa5/visual_studio_2013_express.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b1a00b0-8516-4f69-bd8e-c7af729764e3/atheist_books_amazon.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00007461.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.