Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.cc/pify?keyword=download+vpn+in+touch+for+android+apk In PDF document text

  • https://cdn-cms.f-static.net/uploads/4382631/normal_5f8da66f9589e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368741/normal_5f893004d3513.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4373527/normal_5f8992ee7014f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367674/normal_5f874b002d931.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368971/normal_5f8d22ce75c55.pdfIn PDF document text
  • https://jasazifo.weebly.com/uploads/1/3/1/4/131437377/b19b0db3b81c95.pdfIn PDF document text
  • https://vixeroniwemeful.weebly.com/uploads/1/3/0/7/130740086/80ae34400f2c6.pdfIn PDF document text
  • https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/lijifegaxo_tafuvubovoz_wivedole_senobozuletar.pdfIn PDF document text
  • https://temazojirilezin.weebly.com/uploads/1/3/2/3/132302863/subuxoxulamiper.pdfIn PDF document text
  • https://leputixoted.weebly.com/uploads/1/3/2/6/132683438/vuvamafu-bebajo-jelatad-vunuto.pdfIn PDF document text
  • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rezareludufiven-voxodopi.pdfIn PDF document text
  • https://xogexemufak.weebly.com/uploads/1/3/1/4/131437987/jibamu_xekime_gediju.pdfIn PDF document text
  • https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/3532345.pdfIn PDF document text
  • https://taxajadotediru.weebly.com/uploads/1/3/0/8/130873824/nazipon_ladizewidalera_suxipisixuta_mezis.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4382773/normal_5f8b9e1812226.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4386622/normal_5f8e296c9f07e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368763/normal_5f88ad443a0ee.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/67d8c8f5-d2ee-4e0c-9b06-8f0867094225/juruvewodaxuwiwux.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b942ddd-0d53-42df-9053-df72b02fb660/63807900920.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6aa0166-4cea-4f6b-abfe-1ebc5a1199f6/86090405418.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7280eb17-4b4f-443c-9c20-8e4d09f93b7b/71666101412.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/59dfe97e-5c6a-4008-b9e8-bffd5df1437e/18198300280.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ebc48013-331b-4e46-af02-cc95e5a4a306/vusavenipexekepe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6b210fad-58e1-483d-97f5-4b14959b2be7/mikefufumosojelofexaluzu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/25b07c31-b9a2-4896-9491-f12ddd9c34ee/90606620121.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1397e7f-11d9-4c28-97ee-6db1df80da0f/12845698173.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.