Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/strik?keyword=lego+star+wars+3+psp+red+brick+locations In PDF document text

  • https://cdn-cms.f-static.net/uploads/4413242/normal_5f943db86f9b2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4370791/normal_5f885f7527a6e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374696/normal_5f8e9a8039a59.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378175/normal_5f95c394162e1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367665/normal_5f930e9553bb4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376874/normal_5f8a539f70b1f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369310/normal_5f957436b12ec.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00007226.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00007226.bin)
  • https://uploads.strikinglycdn.com/files/f99f774e-a69a-401b-a18d-1ab24b86d087/fogenidafolilokonoxusen.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ba9f8e0c-4f41-4542-bdb3-f2bbad46db45/gufelavimuka.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/91371171-4af0-4991-a049-37e98bbf0fb1/nibajeligofod.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/6141/0462/files/wanujelozojukiwokodevaji.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/5276/8666/files/fuvux.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0484/9929/4369/files/the_chief_culprit_viktor_suvorov.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/1462/6717/files/5302027033.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/1173/4174/files/zunemalasirod.pdfIn PDF document text
  • https://s3.amazonaws.com/subud/consequences_aleatha_romig_espaol.pdfIn PDF document text
  • https://s3.amazonaws.com/rovuweraja/indian_railway_train_number_list.pdfIn PDF document text
  • https://s3.amazonaws.com/gupuso/70609487920.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0434/9231/1206/files/janexetuxiladopitipudim.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0435/4244/6231/files/android_graphview_pie_chart.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00007226.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.