Malicious PDF — malware analysis report

Heuristics 4

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gettraff.ru/strik?keyword=top+1v1s+tk In PDF document text

  • https://s3.amazonaws.com/zarelusipofox/vodupomesuwu.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374359/normal_5f96fe24b0f38.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374181/normal_5f891af629b94.pdfIn PDF document text
  • https://s3.amazonaws.com/vibuvomomuv/37243063569.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378405/normal_5f8ce2b2b9007.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4384645/normal_5f956ba617f26.pdfIn PDF document text
  • https://s3.amazonaws.com/wutezigojuxi/download_surat_al_waqiah_latin_dan_terjemahannya.pdfIn PDF document text
  • https://s3.amazonaws.com/megelugik/basic_algebra_questions.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366321/normal_5f875188a2026.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375356/normal_5f9240b344188.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366969/normal_5f89fb52b41f7.pdfIn PDF document text
  • https://s3.amazonaws.com/robumuduluwise/5th_grade_math_review_worksheets.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365540/normal_5f8704be7b932.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4379959/normal_5f8decc742b87.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/51389407-ebe6-4124-9235-5ef6de8e368b/zakubepaz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2aeb52ba-858f-45d5-bdcb-35708437e701/pukexemuvemes.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0483/8296/7957/files/15456271863.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/0524/6112/files/medical_fitness_certificate_sample_format.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0430/7877/9047/files/ruvalamilemepuvu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db9d226b-6b7c-4fbc-8b8d-bc6883453b5d/centech_2000_watt_power_inverter_manual.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/6580/1374/files/motorcycle_mechanic_manual.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0484/3510/1850/files/lelewawibi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.