Malicious PDF — malware analysis report

Heuristics 4

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.me/aws?keyword=capsulitis+adhesiva+de+hombro+tratamiento+pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4366327/normal_5f8745bfd12d4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365638/normal_5f90a2115a9ff.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368762/normal_5f8c2646c5dab.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367625/normal_5f8846cb1ac5e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368736/normal_5f88720a139f8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4382790/normal_5f91b99253740.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4379053/normal_5f8f21a5b2c84.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4370066/normal_5f914f4b082fd.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365620/normal_5f8dc29ce97a1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4373983/normal_5f906a3c05e32.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366336/normal_5f90c880460b8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368492/normal_5f883f0797da2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367633/normal_5f87b03ac0de5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374189/normal_5f8e179fa6ccb.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off00007cc6.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off00007cc6.bin)
  • https://uploads.strikinglycdn.com/files/99165751-ba8c-49b6-8f3a-e455e002fdbd/44986124466.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bbc79c28-98d1-4639-92b6-b1b9d6db68f0/77088172781.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bcf9a512-67e4-4583-adff-e16a53c29325/www_sat_com.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b10f158-3e9e-4e5e-b631-8d4eb47c619c/rulajizusavumezonekizinak.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/99dfd27a-046d-4bc4-a77a-f1420501c896/79167974571.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72868137-c06a-444e-ae42-a05d3691afa9/sogew.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1cdad311-fe66-4ea5-949d-6309aed27802/zinuzimometek.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/788f12ca-821d-443b-962a-dcc6524b3a14/puxiw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f7490c96-7194-4826-906b-831abde3b438/56202433413.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5c03a59-bcd6-45f2-83c7-7e7050a68d46/80240358469.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eb20c829-e500-4b18-82aa-a2250536b013/teberenijuwobotav.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3aae1736-271f-4204-a34f-5303e531ce8d/game_dev_tycoon_mods_ios.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off00007cc6.bin)
  • http://dejavu.sourceforge.netIn extracted file (font_02_sfnt_off0000b35f.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_02_sfnt_off0000b35f.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.