Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.cc/123?keyword=lineare+gleichungen+mit+2+variablen+pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4369165/normal_5f8b4e077eb6d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367622/normal_5f87608a58d50.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366645/normal_5f873b12b58b6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366676/normal_5f890c9bd750e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372972/normal_5f88bdeae819d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/e09f0010-050e-47d9-a2ec-1cba71822a2f/79262815046.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e3d5fd4-0fea-4b67-86f6-5055e9e5b599/53045895041.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/13398fc2-cd49-48cc-a99a-af78deab07d4/54020198925.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a4f46ea4-77d8-4ae2-9f65-ca749f59f557/49169789001.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/33dbc3ea-c517-4273-bd0a-69d7d6c8938e/wutizuninow.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/6134/4406/files/84188811316.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0472/2920/6693/files/lumokadowepafatawa.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0432/0319/9138/files/modern_economic_theory_dewett.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6f618bd-948b-430a-8d74-1226e791a4e0/xikusokom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fab10e97-461d-4594-bba0-a5fdd5d38d83/52526035272.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f7edb82-612d-441f-9eb5-ff0d79dc1287/xewogenumodowifewokev.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7148d31f-e74f-4837-8d4e-ba6e799d8bda/mijovotoj.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55bf07a1-dce2-4eab-b431-2f915d0a164e/fominogiton.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b5b6a264-d835-419a-8ba9-5dc10aaff881/86800643611.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/738973a1-1a37-4b72-97ab-ae2789e73693/zikiribup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3289e36c-ed78-4af9-91d9-42c0e4bef71d/92531391469.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d15feb53-f6f1-4e99-b108-6c889ce6f844/nukatejagewexexamaji.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/127a3627-8f9b-4284-aa94-c74cc6986110/33446466555.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7b22d161-0970-4539-95be-7d263c2b2fcd/99222609509.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e848fc9-85ac-4713-aaa7-c77987108943/79666444775.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.