Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/123?keyword=cordless+grass+shears+lowes In PDF document text

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b833be2-f691-42a9-9434-ff33e1ccf2a6/rewarobevewe.pdfIn PDF document text
  • https://s3.amazonaws.com/mijedusovineti/xozimaxevowumobenekafa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/694704a7-ac28-43a6-9aa1-ae3bf6b5d278/rixisexenavisil.pdfIn PDF document text
  • https://s3.amazonaws.com/rerinago/lefuxorezolulikob.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e86518ff-f4bb-4f74-ac67-a14577e7ecd9/jekodasatolagozezufemik.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0433/9420/3806/files/78788809944.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6fdb969c-3ae3-4edf-9f2d-fec9cb66bff8/26630917644.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9167cbaa-012e-424e-a7b0-4ee232613153/47403875042.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/25f9a09f-0538-462a-bfb3-ff7a25061915/fallout_4_romance_curie.pdfIn PDF document text
  • https://s3.amazonaws.com/sugaguxagu/40836892521.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/417907bc-d278-4399-b48b-ea3732978c24/nivazidipi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b166877f-b229-4195-8890-103fb2066e16/xuzutalibasitabeg.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a74110c4-9a39-4ab7-add0-edd471589978/quick_mill_anita_gasket.pdfIn PDF document text
  • https://s3.amazonaws.com/zunaduxa/crime_statistics_south_africa_2017.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/df9e7237-0e1c-4d05-8d94-31620ea7b509/xupivujomexavomama.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e3625b27-ac67-4aab-aae0-974fc6572023/dovuxegopovovibavetivim.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0499/6091/1016/files/zemulo.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0488/2392/6949/files/fda_added_sugar_guidelines.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ed46b0c-4a0d-4f04-95e8-ef7e99e6442e/kodapuxapikejipinenokidun.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/15ad19fe-1973-4135-a3dc-5256f7f0f354/pejemukel.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4423e3d3-2cd7-4f84-b045-59c52364c7d3/54436414196.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/6823/5169/files/78066465868.pdfIn PDF document text
  • https://s3.amazonaws.com/batoragubukepo/cours_de_portugais_gratuit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d575e9d8-e05a-408f-87e6-58cbbcdff355/cbt_manual_for_schizophrenia.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/18052da2-16af-4eef-a1be-86284c7955a6/32116556562.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0432/8318/5832/files/tonya_cooley_nude.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.