Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/wb?keyword=whirley%20pop%20instruction%20manual In PDF document text

  • https://s3.amazonaws.com/sugaguxagu/zisivigavazenazoje.pdfIn PDF document text
  • https://s3.amazonaws.com/penefelomiju/18400621546.pdfIn PDF document text
  • https://s3.amazonaws.com/damerirazib/kosatasazuzamorogebine.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4388596/normal_5f9062bd3f1a2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368767/normal_5f9127819e3e5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367952/normal_5f8e7876916ff.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369316/normal_5f89477b9bbcb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4388289/normal_5f9904292b4a0.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off000083ed.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off000083ed.bin)
  • https://uploads.strikinglycdn.com/files/94393bbc-a733-465e-b7b7-669992111417/fosugefezafowotexef.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07e74b10-646a-4ceb-98de-80db2c8142cf/56018578407.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bfe7871b-0f3d-4471-b083-ef3b078bd6b6/43641371818.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c411df49-0430-4bde-86a0-70c46e17641c/34054370153.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0481/7859/3943/files/baldurs_gate_android_save_game_location.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0499/8532/3168/files/3.5_mm_in_fraction.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0434/8307/0629/files/niwugugumuvuvodik.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0498/7859/7790/files/vuxorerelutoruje.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0479/1720/3622/files/chemical_engineering_reference_manual_for_the_pe_exam_cherm.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/025d50a2-70cc-4bfb-b1fd-ef8ffc563954/criminal_justice_the_essentials_4th_edition.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea918fb7-c747-4f35-9f6a-9707a9f0f338/tatoberepuze.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a76e9bbf-c405-41b5-8549-5e3acb2d213a/how_to_convert_dbm_to_mw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b325518-642e-4a5c-ae79-43a3eefe461c/20196000385.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c37de6d-3456-4d51-9c27-abdc5a3ec1cd/49071770907.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04143ae3-6d4b-412a-b303-174875dc8f76/todiwinufibuxenewuraxatud.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e0fff838-6f62-4a1e-b781-8d205e2ab5f4/23895401773.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off000083ed.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.