Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/strik?keyword=mai+dekha+teri+photo+song+download+p In PDF document text

  • https://cdn-cms.f-static.net/uploads/4379377/normal_5f8c27686c892.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369764/normal_5f88ecb85989b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374710/normal_5f92a2b56ff76.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4412761/normal_5f950c4a155e9.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off000054cf.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off000054cf.bin)
  • https://s3.amazonaws.com/felasorarabipis/actividades_generos_literarios.pdfIn PDF document text
  • https://s3.amazonaws.com/xanebavifamopez/67167118689.pdfIn PDF document text
  • https://s3.amazonaws.com/gupuso/91725444773.pdfIn PDF document text
  • https://s3.amazonaws.com/zirojopemup/different_types_of_meditation_and_its_benefits.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d1dff417-df03-4789-a480-ced6c4f2067c/8436347857.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/174467a5-5707-49fd-88ac-c926d1e87fc4/pewudetoxaragesonodef.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a84e3099-016e-4c2a-b50e-6138854ca68a/36279547302.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/62f33b4f-7a1b-44e5-8102-1114f5e1b13e/zusasufutav.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c0e24b0a-4bf2-40bf-afd7-ecd33c0dd733/17878028156.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0397/9332/8315/files/rebateboboxojubojok.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0486/0752/7077/files/38456940764.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0500/3922/6518/files/red_heart_team_spirit_yarn_patterns.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/4305/9862/files/exodus_gods_and_kings_imdb_parents_guide.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0502/9947/0018/files/88334245216.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0438/1966/3522/files/11323223401.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0428/5435/1015/files/vifupifatajase.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8bca1b05-04fc-41e8-8c0f-fbcd29a57cd3/bebeza.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/30056e8a-5b6c-4631-ba5d-131b7781fa6d/87465023919.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c9f43d9-6b45-4d4f-a7b2-84fdb485304d/7662310537.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5bcd2713-ecf4-4f16-afb9-b73f40c3da9f/jodifaz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/145c0590-fe55-41a2-907d-55aa938c97ec/campfire_song_ukulele_chords.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off000054cf.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.