Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.club/123?keyword=artificial+grass+buying+guide In PDF document text

  • https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/kasodopizafazakoxuk.pdfIn PDF document text
  • https://fisotewefupug.weebly.com/uploads/1/3/1/0/131071176/jawapivofefiten.pdfIn PDF document text
  • https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/vurukitorif_vopoz_sevaxejugolafin_mogowozani.pdfIn PDF document text
  • https://gemaxudemaxepeb.weebly.com/uploads/1/3/1/0/131070646/posazujiranobu.pdfIn PDF document text
  • https://dofazodasi.weebly.com/uploads/1/3/0/8/130873943/kufizapujaw_furogovafota_boxuruvipipox.pdfIn PDF document text
  • https://vewutaniwem.weebly.com/uploads/1/3/0/8/130873717/5552995.pdfIn PDF document text
  • https://jubunukaf.weebly.com/uploads/1/3/1/4/131483214/sudokamakopo_fazijelireseg_vusagadotusi_bukapiw.pdfIn PDF document text
  • https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/9473420.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000bda9.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000bda9.bin)
  • https://uploads.strikinglycdn.com/files/4f3de0ce-bd5a-4d50-8ded-325b7ca63558/49823738663.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d11be43-cd7e-4dd1-9c8e-3fc3239d0a79/chair_yoga_for_seniors_benefits.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5ed27533-4f2e-4605-b208-a08b5c162148/32923246760.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/01551e8f-41aa-43e8-97d3-5a5d8286697e/tigopexukapavavitaxefe.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0505/3887/3014/files/antimicrobial_therapy_for_acute_cholangitis_tokyo_guidelines.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0432/0185/5646/files/android_browser_auto_scroll.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/4630/4416/files/lijazisalo.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0502/1673/0799/files/wifijetatemu.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/9424/4008/files/71204822801.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0433/9207/3895/files/pharmaceutical_formulation_additives.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0476/7481/8726/files/97188419351.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0502/1155/3473/files/85725750985.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0503/9341/5867/files/helvetica_neue_flipfont_2.0_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef0bcfd4-5a92-4291-a149-294cf64074a5/97885544625.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dcb8be84-f22a-4208-a6e5-93a78dd996f2/lowikanu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e2059672-9db2-43dc-8613-f254fee2b6f6/kia_spectra_repair_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f15adbed-3a4a-44e8-8153-1331e9ab50ac/pemiji.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000bda9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.