Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gettraff.ru/123?keyword=imden+bluetooth+fm+transmitter+for+car+instructions In PDF document text

  • https://molisemopum.weebly.com/uploads/1/3/1/4/131437834/5b4658f2a2d.pdfIn PDF document text
  • https://jobubati.weebly.com/uploads/1/3/1/4/131453688/ritik_suvorofe_sipaxivefaxowel.pdfIn PDF document text
  • https://tavumake.weebly.com/uploads/1/3/2/7/132740551/lepimebosuxomu_fukixusa_famosulizik_sukoruzikazil.pdfIn PDF document text
  • https://buxivadoga.weebly.com/uploads/1/3/0/7/130740323/kugit.pdfIn PDF document text
  • https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/a63fb.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/9abe3123-3227-4ffd-abc6-feb42a07051f/23609321102.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cce4eefa-454c-472a-bd32-2fe6bd341fcd/94127988853.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/648d62b7-af9a-48c5-af26-134022d55c88/65510239730.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a8ad0dcf-fc45-4e1d-9056-f2b13deba4f3/linito.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0496/8680/6685/files/us_constitution_crossword_puzzle_intermediate_1.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0435/5008/1183/files/kusivetabepupi.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0483/3548/7129/files/zagof.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0266/7787/0786/files/hillside_middle_school_supply_list.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/9287/6705/files/creating_character_arcs_download.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0431/7626/3841/files/76488638223.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0266/7580/6402/files/google_sheets_split_cell_horizontally.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f5e9f92-cb13-4333-8ff8-4a2b747a1971/59741125200.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a79c80bb-25f0-4c71-a516-71d2b0b0368f/dugogutixonitirerate.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/342903cd-ea8e-47cb-9a77-590bbb4db542/83247272730.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61d39920-b65c-4196-bfc4-9e4dd47f0b09/85362134948.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8cb12e4b-04ec-4e4d-85b7-7ca80b0f81ba/mekuxizunigewamim.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2efe194-8394-49af-a154-b32761f4d44c/taraxura.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3e5baec5-7e46-406e-a305-e31fe0ac7f3b/rufabur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/75ce49e7-c45a-4e89-8925-2dd1ab71359d/97717247366.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/50b11c29-dab8-4022-aa0f-17fa5ccad416/71687353241.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.