Malicious PDF — malware analysis report

Heuristics 5

• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://oapsirs.com/c3?utm_term=ecological+succession+activity+worksheet PDF link annotation

  • https://xevirurij.weebly.com/uploads/1/3/4/3/134357690/292284.pdfIn PDF document text
  • https://tidijutaxidekoz.weebly.com/uploads/1/3/4/5/134589823/nakomawugamibiweputo.pdfIn PDF document text
  • https://sijevunima.weebly.com/uploads/1/3/1/8/131859613/f52bd2fd512f352.pdfIn PDF document text
  • https://sidagavaru.weebly.com/uploads/1/3/2/8/132814791/fe2e36ea503bb.pdfIn PDF document text
  • https://morisoxurekes.weebly.com/uploads/1/3/4/4/134464458/dinosajolobufa-dezuli-jopomuvabif-mefekuketu.pdfIn PDF document text
  • https://wobifeda.weebly.com/uploads/1/3/1/0/131070490/7ca139ee.pdfIn PDF document text
  • https://mutebomex.weebly.com/uploads/1/3/2/7/132740724/rasaravotagawedo.pdfIn PDF document text
  • https://xitofubipu.weebly.com/uploads/1/3/4/3/134375163/tolopimarubenukumime.pdfIn PDF document text
  • https://sedadiwetatu.weebly.com/uploads/1/3/7/5/137504668/1ce5d8a3dce9f5.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d166b4527e4130cd8836c6/1657890485094/lettre_dun_soldat_a_sa_femme_premie.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d36d2645137d2c5996f8fd/1658023206750/adele_sheet_music_set_fire_to_the_rain.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62deb1f9741b3331274a0261/1658761721795/catcher_in_the_rye_study_guide_chapter_1-4.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e5cf8ef1e8ac596366a1b2/1659228046192/gotutubewulog.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62dfbfff528d6a3af1048d03/1658830848030/estimating_products_worksheet.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e498bddb56d8327d90c748/1659148478260/triggered_feminist_meme_template.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62d6f99948a8e961b4ad317f/1658255770093/mafagiwax.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62c3ac0b5afcae5eb9d2991a/1656990732067/among_the_living_psycop_read_online.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62e38b631dd35d028b63d345/1659079523795/sapojuzaveneponub.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62e49bd8db56d8327d90f46e/1659149273105/tezobinirekutaburinofere.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62dc6a0798d0b82988da0074/1658612232444/65223340582.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62cb94822acf6c18d7161afb/1657508994584/nero_7_portable_descargar_gratis.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62b62b41b5ff16476c609668/1656105794294/best_drawing_books_for_beginners.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62bbad78dc90d93d08ea4020/1656466808688/harry_potter_and_the_quidditch_world_cup_free_download_xbox_full_version.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62d20c9040b27f74f11e22a7/1657932944415/12647979727.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b6bb6322619543dcf9ecb6/1656142692434/komatsu_equipment_serial_number_guid.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62c388ca3e63957aeb44e962/1656981706779/vimego.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62dd4d5e8a53df4b0f38b48b/1658670431329/70282520721.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c1f617bf9aba464d8f3b11/1656878616394/the_instant_pot_electric_pressure_cooker_cookbook.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007cb52.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007cb52.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.