Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/123?utm_term=blast+furnace+minigame+guide+osrs In PDF document text

  • https://cdn.sqhk.co/fugovigul/LuH4iiY/bingo_boards_printable.pdfIn PDF document text
  • http://nofomox.22web.org/55072713042.pdfIn PDF document text
  • https://cdn.sqhk.co/fuzomorikat/gV6sGHM/how_to_use_vlookup_across_multiple_sheets.pdfIn PDF document text
  • https://cdn.sqhk.co/pewesopefim/9ibkHgj/drum_machine_sampler.pdfIn PDF document text
  • https://cdn.sqhk.co/mofipife/Gjjhh3k/35929352810.pdfIn PDF document text
  • https://cdn.sqhk.co/vilonunufuk/iRtFU3J/piano_tiles_easy_songs.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_0f90fee4079943cd9e3768069845f1c2.pdf?index=trueIn PDF document text
  • https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_cb64fb238c004797ac883f5e8f84d3de.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c3ca4722-1fc5-420f-85b1-b450ab72d6de/fluke_1507_manual.pdfIn PDF document text
  • https://17500468-634e-4f48-81ad-48a4a068d6fa.filesusr.com/ugd/dcac76_7f9c3533d77a48bf91bf30dc8c0cd60c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/758bbe2e-1ced-4727-8f15-928bfba70e95/adobe_premiere_pro_download_mod_apk.pdfIn PDF document text
  • https://95fbbc11-640f-4658-acdf-6e09da746871.filesusr.com/ugd/e42ee3_baad30fb0ee746ac80796f4f30ad5d45.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/68f91265-38fc-41a1-af9f-a200dbeb4ff2/sezofaduxiduniva.pdfIn PDF document text
  • http://robinovedibepo.epizy.com/convert._lrtemplate_to_dng.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a3830256-ee7c-4c90-a794-19ff9dd6b5b5/73681537825.pdfIn PDF document text
  • https://51fd5013-30c4-43d1-89ce-86564632a3b5.filesusr.com/ugd/9f06f8_f4f50faa5ebf400984eb517ba9012c74.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2061e606-b34f-4185-9d2e-a4f4a743ae17/jatarefakuwoperikogeke.pdfIn PDF document text
  • http://javewexo.epizy.com/talleres_de_autoestima_en_adolescentes.pdfIn PDF document text
  • https://178c1879-e916-404b-9861-a2431bd0f83a.filesusr.com/ugd/1aace6_4e953f105bc74fa6a68148706678af81.pdf?index=trueIn PDF document text
  • http://volapubexu.epizy.com/zuvesepexoxamuwagugu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/398b205f-8e66-4691-9807-f634bc99eb17/can_you_write_calligraphy_with_a_fountain_pen.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/37f8fe75-6df5-4cdc-a834-18b996b80b1d/57435770649.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3b150c3c-60fa-40c0-adfc-360b05912169/lipidozolu.pdfIn PDF document text
  • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_0df2571e7c5540a2b859d6655656e9f5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/681ef872-6142-4fd7-819e-2436c8a41fbd/sudimilulole.pdfIn PDF document text
  • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_e8579dbffa1b4d83a5cf843a23e7c186.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.