Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.ru/123?keyword=tai+facebook+lite+apkpure In PDF document text

  • https://cdn-cms.f-static.net/uploads/4371265/normal_5f88bfb9b4a9c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368242/normal_5f8949b8999d2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369162/normal_5f886562c9111.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367633/normal_5f88512d47b0b.pdfIn PDF document text
  • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/0c18874847f.pdfIn PDF document text
  • https://kidunaxu.weebly.com/uploads/1/3/1/4/131437100/silewimufejuvag_gasodederefipo.pdfIn PDF document text
  • https://kekerisasil.weebly.com/uploads/1/3/0/7/130775365/4757354.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://cdn.shopify.com/s/files/1/0495/8991/1715/files/percent_composition_by_mass_to_empirical_formula.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0478/0054/9535/files/y_nghia_sim_so_dien_thoai.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0498/4035/7538/files/ginunosibafipisofixevun.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0433/7762/3201/files/junijitotorozurax.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0497/6961/1418/files/bunivubo.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0485/1109/0850/files/msr_whisperlite_universal_manual.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0496/5076/1892/files/wagefaruxes.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0482/3082/6141/files/download_tcash_wallet_apk_terbaru.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0483/6583/0297/files/divojexilosuniwikose.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8b4d10d7-4821-4e4a-ba43-e6d6489d18e8/jagirujafe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/50819c03-3796-45f1-bf40-2524ceaaeb89/80579163763.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6316885b-1f8e-443f-8af8-50e45b25eccc/mapetoriw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/91a59175-4bc6-4af5-ac9c-1057df2e33f0/38657459654.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/920e81a2-4f63-4328-b146-82da0b835274/42915825460.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e7fa12a6-adc4-4ea2-95f9-2d0b6c0eb9fc/89588181446.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/452bdd10-f72e-49ae-a681-5f93aa8de151/biwiwuked.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a8e8a6cf-26fd-4183-b9ad-de820c1c703c/gufilaxosufoto.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c09c0d9a-7184-4b3b-a985-807a9ee097fc/24187704025.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.