Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/123?keyword=wilson+muir+bank+elizabethtown+ky In PDF document text

  • https://cdn-cms.f-static.net/uploads/4366335/normal_5f890f5704a42.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369774/normal_5f967f958f3aa.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4382196/normal_5f8f1d74a3a1f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4371787/normal_5f88f1dc25c19.pdfIn PDF document text
  • https://buziratefe.weebly.com/uploads/1/3/4/3/134354065/nujipatit.pdfIn PDF document text
  • https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/furowivawumemu.pdfIn PDF document text
  • https://givexikiduxa.weebly.com/uploads/1/3/1/3/131398224/purapi.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00005882.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00005882.bin)
  • https://uploads.strikinglycdn.com/files/a03ec720-55bd-44b4-9411-d5b380424f85/11350384832.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7fddc198-4b3a-42e0-bede-687ff4560ae7/77681167996.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/051ce10d-a7cd-49c2-8ae1-d28f131af42d/joxukuwujexuka.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4f3b9637-da29-49ff-9366-67656f39ed88/31877586137.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/779d29e6-dc7e-4f3a-817c-0ac19a213b7b/bifipabumavolel.pdfIn PDF document text
  • https://s3.amazonaws.com/mufukep/affairs_cloud_weekly_current_affairs.pdfIn PDF document text
  • https://s3.amazonaws.com/tadovu/nuevo_diccionario_biblico_certeza_segunda_edicion.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0c84b314-476d-4b6b-9b5b-f259bdfb3f03/62332563301.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/33610aea-1bea-49c7-b7c9-11648d7455d5/97009465623.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9590a867-a069-4c6c-8498-76b968d04040/mafia_1_kurtlar_vadisi_modu_full_ind.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cd696de5-a527-413c-8629-86af0f5f44cb/8003591832.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d66c909f-6cf2-4cc2-a64a-6746df5102d1/luvozezosujufanorinapup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3d8859d-5065-4642-9188-3c5252375bc4/redukiwebesabiwumufum.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/17e0b9d7-84bf-414f-8093-6177f630f5c1/ropuvenasebiforagavene.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5317de72-6008-4f29-a091-44ec61b77279/53272263930.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bdc681f6-2eb2-48ab-9323-41d7e95425d7/gijolawip.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00005882.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.