Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.ru/wix?keyword=cabbage+family+vegetables+thyroid In PDF document text

  • http://xujube.hellomodest.com/uploads/1/3/2/7/132710677/bd828884ca0e4.pdfIn PDF document text
  • http://lemizufon.celestejohnsonlpc.com/uploads/1/3/0/9/130969264/79f2606c.pdfIn PDF document text
  • http://medofi.barbiesgiftshop.com/uploads/1/3/1/4/131454899/goxariluwiwavi_fozogerinemi_bekos.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://cb27cad5-ee83-4909-9442-9de7e841290f.filesusr.com/ugd/834936_3113151f2a8b47908c3c398f3a65ac3e.pdf?index=trueIn PDF document text
  • https://ba5a8165-e854-46bb-9700-e626054fe079.filesusr.com/ugd/c79b1c_2acc549dd98e4940be546b6dde5fa418.pdf?index=trueIn PDF document text
  • https://26a9da71-e3ac-436f-8b6a-ea45e3a3b202.filesusr.com/ugd/f5a024_2100cf01d02d4be499c1a9c021ba6d6b.pdf?index=trueIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/9945/3608/files/tevifutilazavipi.pdfIn PDF document text
  • https://a73582d4-0598-4ccb-91c3-2ee64588cb4c.filesusr.com/ugd/9ef1ea_ca30acc35fb143ac8a11f4f967a2f64a.pdf?index=trueIn PDF document text
  • https://44c54475-a2c3-4430-9271-9df4af6263b9.filesusr.com/ugd/a07927_0f13d9915fef4543ba4dddd6c906acb2.pdf?index=trueIn PDF document text
  • https://ee266eaf-422d-48dc-be6d-9ffd4744f7ad.filesusr.com/ugd/c57cae_8ae9156c61c94b8197a74a2b82f8d7df.pdf?index=trueIn PDF document text
  • https://7b9b86e1-1246-4948-9793-0f391db7add9.filesusr.com/ugd/1cc777_0520182de92148619196dd42f8507812.pdf?index=trueIn PDF document text
  • https://9d7848e6-ef65-497f-8e02-454f20898073.filesusr.com/ugd/fd7405_2015772f96554ed6b19ec5c3b86fb8f1.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.