Malicious PDF — malware analysis report

Heuristics 4

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/123?keyword=truck+simulation+19+android+mod+apk In PDF document text

  • https://cdn-cms.f-static.net/uploads/4404107/normal_5f925236d54c4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369165/normal_5f8b94cebb983.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00005ef3.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00005ef3.bin)
  • https://uploads.strikinglycdn.com/files/cf699ca4-dcf5-480d-a3d5-1ad193421568/66385329047.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9b78bc30-ff2a-408d-975c-7246dda6ff7e/nulom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/86a8656c-5c9a-49f2-bac4-de62d4670000/asm_handbook_volume_10.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a2b8bfcc-c4e0-45c1-b78e-4a2dda21f4a4/rutigopixiga.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d9585d9d-0659-4200-825f-7f275d54c4be/76621075198.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4c907e64-740d-4f68-be62-2738acdded5f/40839118808.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/439f3ce1-772c-4274-b1c2-5a07d043cd18/kubunabekuregof.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71fdd293-2e03-4178-9fbb-f759a0431fb0/5917489774.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/39e3a959-c6a1-42ea-98c2-811343404c20/64714859679.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c82c5479-a7ee-4ddb-993a-0d8e6ec4363a/jimitebowowulabam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8dba6c2a-68e5-44e9-a68d-fea4ac97831a/comptia_network_n10-_006_cert_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/230d9ae0-f2c1-4bff-937d-430cf1b8047d/terisadozoneganudez.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ad34694-b878-4f7a-8e8b-116641467f96/bcm20702a0_lenovo_windows_7.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71aadf8d-14e7-471c-b2b2-f7fd6a9958b3/vokifiketejitezuw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b735f694-b6de-4059-9dee-21f1c4383d61/jololado.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fade65c5-7dd7-4d07-ab0e-5757c8e3e914/36431456426.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1545c58-d8cc-47a9-b25b-884f5a20964f/zusimokigeruze.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00005ef3.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.