Malicious PDF — malware analysis report

Heuristics 6

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
  Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.me/123?keyword=applock+pro+premium+apk+download In PDF document text

  • https://cdn-cms.f-static.net/uploads/4370068/normal_5f8cc1a93957d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369509/normal_5f887fa520deb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375195/normal_5f89df6e0ae86.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4386330/normal_5f8cbc71edc35.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369796/normal_5f8b9de82d516.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4390330/normal_5f900ea30c395.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366033/normal_5f87095ec4961.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366044/normal_5f8728ef2d9a6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383567/normal_5f8fa875ab23c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378827/normal_5f8e5a6424bfc.pdfIn PDF document text
  • https://bajusumuke.weebly.com/uploads/1/3/2/7/132741128/rejojokipibofiz.pdfIn PDF document text
  • https://lasajiboz.weebly.com/uploads/1/3/1/3/131379041/a9f43.pdfIn PDF document text
  • https://vatipasa.weebly.com/uploads/1/3/0/7/130775610/554b59bb.pdfIn PDF document text
  • https://wefamojugibe.weebly.com/uploads/1/3/1/1/131164519/filavesunigin.pdfIn PDF document text
  • https://sibakixode.weebly.com/uploads/1/3/2/8/132814768/nofezokepafepilufusi.pdfIn PDF document text
  • https://xonuveviriniw.weebly.com/uploads/1/3/0/7/130738603/sakuramexiperofi.pdfIn PDF document text
  • https://sokuvotaboraj.weebly.com/uploads/1/3/0/7/130776263/natorisa-zowed.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00007e7f.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00007e7f.bin)
  • http://www.daltonmaag.com/In extracted file (font_04_sfnt_off0000d587.bin)
  • https://uploads.strikinglycdn.com/files/34a5814e-9d79-4a84-aa04-3a83255f3cb1/19615832339.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cfc4be20-019e-4f9f-ae0e-744fa7974f97/26938243594.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/26a6273e-3d41-4d4f-8171-78015fb8e8f5/tojajuke.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7f2aa66c-763e-4f2f-8a88-d4f18279729e/sekosenepibuzaja.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef2536f8-bfe9-453b-bc6a-154c45219f96/uygulamalarla_siber_gvenlie_giri.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61a9b27a-a90a-47ad-b73c-94b824b01d1a/38681921110.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00007e7f.bin)
  • http://dejavu.sourceforge.netIn extracted file (font_03_sfnt_off0000bd57.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_03_sfnt_off0000bd57.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.