Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.link/pify?keyword=ff7+android+apk In PDF document text

  • https://cdn-cms.f-static.net/uploads/4380545/normal_5f96557c1c405.pdfIn PDF document text
  • https://febixitojujemo.weebly.com/uploads/1/3/4/4/134402622/197447.pdfIn PDF document text
  • https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/7539717.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4414494/normal_5f95435b3965a.pdfIn PDF document text
  • https://leruzifu.weebly.com/uploads/1/3/2/3/132302941/tewenizobaxuva-tewuvabiximo-losajefoto-wasotavolav.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376625/normal_5f8c6b7574fb5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374689/normal_5f92743871ac2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4388620/normal_5f99bd7f4014b.pdfIn PDF document text
  • https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/soxadu.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00005f68.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00005f68.bin)
  • http://www.opentle.orgIn extracted file (font_01_sfnt_off0000703c.bin)
  • https://uploads.strikinglycdn.com/files/849c19cb-e258-43dc-8b88-e1f9965c4e86/58156503895.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/09d70624-172a-4f70-bbb7-17e702a010f0/18528041733.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c279e19d-d9bc-44aa-8f6b-b15e1ddbbafb/metometoxavega.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f2f3106-bbec-4545-9fd3-52c818e24b7e/un_ninja_en_beverly_hills_pelisplus.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5b09439-1ffd-49a5-a928-762c978c05b9/81352826194.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3e50ed79-1712-4b68-83d5-fa04be755ffb/12682536397.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2cdb165c-19dc-4dc0-941f-863ce39b16b2/muvabifetubib.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eee95fb1-22bc-40bc-bc08-0b466dd3ddc8/iec_60664_1.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eff4080d-9a34-4a51-a9fd-7922b4b83dc4/juriwavozapa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed700c5d-05d0-47d9-87f1-1ea764c1b1b8/93237878757.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cab0431d-7941-4149-bc19-4bcd6dee9ed9/lesoleden.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fbeae3a1-e3b6-4afc-a2b8-982aaffe4a83/ghost_recon_weapons_list.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dcee0fd0-d54d-4594-8ed0-e83b620c77b2/90919047176.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00005f68.bin)
  • http://www.gnu.org/licenses/gpl.htmlIn extracted file (font_01_sfnt_off0000703c.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.