Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.link/wix?keyword=explain+the+advantages+and+disadvantages+of+unitary+system+of+government In PDF document text

  • http://topelufum.atrendyblogwithmeg.com/uploads/1/3/2/6/132682006/230505.pdfIn PDF document text
  • http://japaze.twkdmsadvisory.com/uploads/1/3/1/0/131071277/971616.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://49194492-0913-4c7d-ab4d-0107923ff752.filesusr.com/ugd/b1b16e_ea0eb3aee0864dfda1c292ef7364bbf5.pdf?index=trueIn PDF document text
  • https://c2c30df1-5a96-408d-92e6-6a870bb459ad.filesusr.com/ugd/38062a_54ea9f354af747bbbf881e9a8b270709.pdf?index=trueIn PDF document text
  • https://68f1ba7f-bbb1-4199-b555-1181fb9cdda9.filesusr.com/ugd/61567a_0204b92c51d44e29b7a1c458b5118ca3.pdf?index=trueIn PDF document text
  • https://f8d0bf06-847f-4730-b25a-f3d3ae7b2dec.filesusr.com/ugd/3225da_d3336fd56c3047a38bb4173ecd8a0a58.pdf?index=trueIn PDF document text
  • https://31173675-f15d-4214-b9d4-14dc878bbe9b.filesusr.com/ugd/0a3240_1ab4c78e511548aeba1e73111420e7d2.pdf?index=trueIn PDF document text
  • https://b2384493-fd70-470a-99f6-c305d13f9f29.filesusr.com/ugd/cc14e4_72e4c25b61824c7392709951c5c895b3.pdf?index=trueIn PDF document text
  • https://6e95cc36-a18f-4020-bd81-7aa513b49ecf.filesusr.com/ugd/61f964_e12148efa0564f62b97d2d8d2b73a198.pdf?index=trueIn PDF document text
  • https://e50942aa-bf08-4c9c-b133-60b7a0449e67.filesusr.com/ugd/bb3bf9_aa812fcdb7ae45fa9dab261dd007a9d3.pdf?index=trueIn PDF document text
  • https://8bad02ed-2586-429d-9bfc-d0d9c7995159.filesusr.com/ugd/724fb5_3cf07ded5113467290b9e575a37bdab7.pdf?index=trueIn PDF document text
  • https://4833a67c-88f2-4d4a-b20b-979a4e4e2084.filesusr.com/ugd/e2f7e1_711493b5245a4790ab237a73685dcbba.pdf?index=trueIn PDF document text
  • https://31b69c70-bde4-4cb3-8712-01ad1c54100f.filesusr.com/ugd/87a178_7f6f94fcc8ce43848a5d5699e76e4b2b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.