Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.link/wix?keyword=bandeya+re+bandeya+song+ringtone In PDF document text

  • http://files.sounbulamills.com/uploads/1/3/0/7/130738619/fodunidix.pdfIn PDF document text
  • http://files.younggunsprofishing.com/uploads/1/3/1/8/131871854/padirudifogur_boxikozatesagaz.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://static.usrfiles.com/ugd/defd8a_63b774044489441b83deef15ea5089d6.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/a4e402_4266cb030254438580ecf37914ac46ab.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/97634b_7f862094d2a34dcbb0cbf1feb44ad3c3.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/21a131_c073862c23a6407e971c1103643bbfec.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/a42eed_580cf469301446acb987a708583cdad2.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/585b1d_1d077beb9e9a411fbb051e246cd5b4e0.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/b56239_65f3db1e21434c96ac25008abe2f4805.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/08e331_7d10a2f4bba94168bd1a5139f19b4f18.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/d43733_2586016e641c41c499e234e8d8e5cb22.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/9ced5d_8880c9a15a864a1ba4cf83e14d163ff1.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/b910ae_b73dd974dc2146618b6da063512014d6.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/ac0094_87e478b9fc504b52b5699d22085a6d5d.pdfIn PDF document text
  • https://static.usrfiles.com/ugd/7a359d_77555f72bd8949a8927c4bcf760254bc.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.