Malicious PDF — malware analysis report

Heuristics 4

• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://foaptoa.com/c3?utm_term=chromecast+windows+10+desktop PDF link annotation

  • https://zilakakazaxo.weebly.com/uploads/1/3/4/4/134442972/0e19274dd.pdfIn PDF document text
  • https://zefemebok.weebly.com/uploads/1/3/0/7/130775969/lipuvavokod-dozuwebe-gutitoto.pdfIn PDF document text
  • https://rutebesutev.weebly.com/uploads/1/3/4/1/134131531/b50ca.pdfIn PDF document text
  • https://pidolanapeg.weebly.com/uploads/1/3/0/8/130813957/nemorasar.pdfIn PDF document text
  • https://dobizonetalede.weebly.com/uploads/1/3/5/3/135394553/3314329.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c06b514a79686cac177b09/1656777553560/sugulimome.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62bf439f59fd7112a83c8786/1656701855467/merck_veterinary_manual_latest_edition.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62dd012176533a2cfedb4ec8/1658650913448/buick_rendezvous_temperature_gauge.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c52fdcc9dc267c651002f8/1657090013082/boatbuilding_with_plywood_glen_l_wit.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62b60aef24b3c03223cdc42d/1656097519367/netbeans_ide_download.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c280963d83d47fbe969f9e/1656914071550/dew_of_heaven.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62cb4683c253b66bc32e4fd9/1657489028134/4385157938.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62ced8ba40e88236d660c3fc/1657723066710/wuxawokol.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62baa8ffe55fe9333722c98c/1656400127814/wolseley_speaking_showroom_calgary.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62ce7fe0f629a048785a7df8/1657700321280/62374411764.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62d4aca85552ee2faca4cdaa/1658105001385/savowakamalazopitita.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62bc54a97a03fa127e19796b/1656509609925/1738357614.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62bf089b3b88bf651e41a8f0/1656686748476/82589942698.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62d3308d5992c6343f503e6b/1658007694173/nitij.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b2ee2c5fc2fd3f21027d36/1655893548370/configuring_ospfv2_on_a_multiaccess_network_answer.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62be5138a219875f1f23cc5e/1656639800877/66358311439.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c0fafd5afcae5eb996e2b4/1656814333736/maitre_s_pressure_cooker.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62d7709f2ab0f75c1214c09e/1658286239240/si_hubiera_espinas_pelicula_completa_en_espaol.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62be442425b6ea5dbe62e351/1656636453151/enseanza_de_las_matematicas_en_primaria.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62d537a11798521b4e0f3262/1658140577456/fraes_algbricas_exercicios_resolvidos_8_ano.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c68a72a3d51f1f2d085a9c/1657178739048/9676469953.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62db2bb0cb7ce95848608bb1/1658530737417/english_comprehension_worksheet_for.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0002b8c9.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0002b8c9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.