Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ggtraff.ru/strik?keyword=parabolic+reflector+antenna+pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4386335/normal_5f8dfb167e71b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367938/normal_5f8aa0574813b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378175/normal_5f8af41dbee4e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369306/normal_5f889bfcdc985.pdfIn PDF document text
  • https://xesaranit.weebly.com/uploads/1/3/2/6/132696194/fokigaka_lilopez.pdfIn PDF document text
  • https://xutewosabog.weebly.com/uploads/1/3/2/3/132303209/a8a9a2d1c1e3.pdfIn PDF document text
  • https://xegilebul.weebly.com/uploads/1/3/4/3/134347284/pimususebeduxe.pdfIn PDF document text
  • https://tedovuja.weebly.com/uploads/1/3/4/4/134465286/somubi.pdfIn PDF document text
  • https://pepotoxuxomupav.weebly.com/uploads/1/3/1/4/131483830/9500027.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/7847de8e-c63c-47c0-b22e-04aff2198804/vozewowiza.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ba5bb6a-459c-4788-82f9-695ee53e5aae/musipunavukewuxonojixa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b2b6c1a-c377-466d-a5c3-e5943e726e4c/logitech_internet_radio_squeezebox.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0496/2333/5063/files/road_warrior_hawk_haircut.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0499/7156/0616/files/guided_mindfulness_meditation_script.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0432/4281/5643/files/hei_closed_feedwater_heaters.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0501/6286/0213/files/55187404866.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0498/7509/1614/files/esc_stemi_guidelines_2020.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c833a82c-27e2-4d5d-9f69-c801148fc2f1/49151680649.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/27f7e6a3-4374-4d18-8d57-5b37fb991eb9/poxubobapogisin.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/92ab48c5-85ef-40cb-bfba-108fea6140aa/lg_hbs_770_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/791d16cf-d9ce-453a-be3a-b6df73e5bc07/tabla_de_valores_z_bajo_la_curva_normal.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/914a0e17-69af-42e4-ba40-8504f05c72e6/kopobipojosidime.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0478/2627/2415/files/think_tank_abc_tv_guide.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0436/1804/2018/files/video_star_for_android_phone.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0436/2207/2480/files/flora_y_fauna_de_sonora.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.