Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.club/wix?keyword=will+slimes+spawn+in+light In PDF document text

  • http://vugiju.248mpr.com/uploads/1/3/2/6/132695478/tenusupinof.pdfIn PDF document text
  • http://files.aminzargar.com/uploads/1/3/1/3/131398131/jejijewagofepegefe.pdfIn PDF document text
  • http://files.behrendsfeed.net/uploads/1/3/1/4/131438240/gopizorixonuk.pdfIn PDF document text
  • http://files.brineandbroth.com/uploads/1/3/1/4/131407061/651213.pdfIn PDF document text
  • http://files.mustardfitness.com/uploads/1/3/1/3/131383763/nategexo_jidonamonewi.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://cdn.shopify.com/s/files/1/0429/4914/8828/files/53154713602.pdfIn PDF document text
  • https://0b67010b-b8c8-44bb-be2e-a265db632184.filesusr.com/ugd/f59309_45f9b0bd835e4a249f8dc6360c976a00.pdf?index=trueIn PDF document text
  • https://11cbd126-188e-4e08-a01e-f4867c3bed09.filesusr.com/ugd/008e52_e9c6c8b56cce496c9d8492bc015bbd75.pdf?index=trueIn PDF document text
  • https://0e6cc53f-7017-458d-9a04-994b0ad1a5f1.filesusr.com/ugd/9d869b_013cefed8fb54fdb89ea283fb265da2d.pdf?index=trueIn PDF document text
  • https://93a39739-c64b-48b4-a067-092a52efbafb.filesusr.com/ugd/8ebb60_27124c5643f14fdfb764be3a8ae8b4f9.pdf?index=trueIn PDF document text
  • https://4b48d582-fe74-464f-b53b-aed3023fa06c.filesusr.com/ugd/8e6e76_9b176b9ce6e44bcb8925d9f1e5271944.pdf?index=trueIn PDF document text
  • https://92583780-85fb-46d8-8de8-d9c6fde82a46.filesusr.com/ugd/fbccce_ee763e59c4034fab9a04bc26ef543964.pdf?index=trueIn PDF document text
  • https://e49e859a-76c4-4250-afc6-aa85e1b2af00.filesusr.com/ugd/3ed902_3f168afec2fc4145a5cc7dacd96441b2.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.