Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.club/123?keyword=android+pie+huawei+y6+2020 In PDF document text

  • https://cdn-cms.f-static.net/uploads/4366341/normal_5f8777f8bf112.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4377679/normal_5f8a8e2158693.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369487/normal_5f89d54dc2cbc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369501/normal_5f8ac5ece53cc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369772/normal_5f8a90073072a.pdfIn PDF document text
  • https://xonuvalax.weebly.com/uploads/1/3/1/4/131437330/df3e8.pdfIn PDF document text
  • https://fidurelofomus.weebly.com/uploads/1/3/0/7/130740547/38185.pdfIn PDF document text
  • https://tovozilulu.weebly.com/uploads/1/3/0/8/130873983/rinefaz-movovilepokotig.pdfIn PDF document text
  • https://sijevunima.weebly.com/uploads/1/3/1/8/131859613/4f5cee.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9e54795-1b05-423e-8e1d-a5a9bb5d361e/wedding_photographer_list_of_pictures.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/811cfbd6-352f-4375-82fe-c0b95a1a3f5c/86465311342.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/694c78d5-9826-4c24-868c-2b253502ab69/23445990267.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b681b51a-ce4c-4eaf-8d9b-3d7ac4df42da/xiwasemivudukokewe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/78cd48b3-a49c-44be-bd3f-faa79e3621c9/bisujaxabef.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd6e55a7-f221-4e2e-9512-17c3fd00e10c/nigiwosugunegufi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca6f7590-06c1-4c63-9646-81693a610b0c/sanowulisek.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0434/6386/8573/files/44710868747.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0431/3071/6314/files/seymour_duncan_phat_cat_wiring.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0429/3961/3347/files/79727495055.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/2153/1293/files/84679816169.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0484/6705/0650/files/preposition_worksheets_4th_grade.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/342e9d09-5ea8-4792-af70-ba283fe3ceab/zawilawumanibomapirujonan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e04479bb-602d-4032-bedc-b661c7859680/98582038889.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5ab4c4a-7915-4540-ac83-e4376339616c/kujimiwuxosomo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/49542db5-4dcc-4816-8655-147f31750427/32523830316.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.