Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/aws?keyword=scrap+metal+2020 In PDF document text

  • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/6310844.pdfIn PDF document text
  • https://jesasifewom.weebly.com/uploads/1/3/1/4/131453969/1083008.pdfIn PDF document text
  • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/1867598.pdfIn PDF document text
  • https://kajibelewori.weebly.com/uploads/1/3/4/3/134307873/julebogusojagepuziw.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off000060ab.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off000060ab.bin)
  • https://s3.amazonaws.com/kavitokolezub/1645148252.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5560ec0f-41e2-4223-a3c8-a0814f55a048/calculus_7th_edition_stewart.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/772e31b2-2fa0-4541-a2aa-c2395da3a6eb/lurevafubup.pdfIn PDF document text
  • https://s3.amazonaws.com/vavabi/97345463938.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2ce7d2e3-2bdc-4b9b-a0c8-fd1fae9574f9/high_school_english_grammar_and_composition_self-practice_book.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ded619c0-efb7-4e7a-8fe8-6ad08839f55d/elio_sgreccia_manuale_di_bioetica.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cab4c52c-9917-4d85-aba7-6f4e76d4e250/kabalah_aplicada.pdfIn PDF document text
  • https://s3.amazonaws.com/jevuxozazebazug/on_a_dark_desert_highway_cool_wind_in_my_hair_shirt.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/542bbf6e-a244-4b78-bc24-dc924315b88d/ac_odyssey_setting_the_stage.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b6672877-ec33-49c0-847c-520cb8ab10eb/47259334715.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b1627290-53e6-4aaa-b0ad-1936a1b5855b/razigimesenuzubodi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4bb2a408-4ce6-4d9d-9c62-2d6499de1023/xebumup.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off000060ab.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.