Malicious PDF — malware analysis report

Heuristics 4

• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://traffset.ru/123?keyword=value+list+assassin+2020 PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4403819/normal_5f9f68b753a8a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369509/normal_5f8c4c14135bc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4412161/normal_5fa5df32f2a09.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2d6438e-343c-4d56-b4cb-d593110c7edc/zuzo_drone_instructions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c4bb3af7-d502-4461-ab1b-5906581f4693/ignorance_and_want_a_christmas_carol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/801c2f0c-5491-41a0-89e7-8b0d957f52ee/69369953780.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/49160f99-7f40-4c6b-87f3-bdf1108b88ec/fun_unblocked_games_age_of_war_2.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3b94bb82-461c-4ca7-a60b-5952abe91df0/bmi_Rechner-was_sollte_mein_Gewicht.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6cc83dbd-5482-494a-9267-540630650869/seneca_high_school_nj_football.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b060290-17c7-4411-9146-26333b0c704d/29207717057.pdfIn PDF document text
  • https://s3.amazonaws.com/kavitokolezub/25038402779.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a0d0d08-04d1-4956-ae63-26bb4dd1b89d/33135468739.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fe78d767-7bcf-44df-8a74-32d36bf75246/sitolitazadaxa.pdfIn PDF document text
  • https://s3.amazonaws.com/gajejasa/bob_drake_ford_truck_parts.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.