Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/aws?keyword=clinical+anatomy+of+knee+joint+pdf In PDF document text

  • https://cdn-cms.f-static.net/uploads/4366340/normal_5f8710e425fcb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376856/normal_5f90c6ca3743b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4370304/normal_5f895020cc38f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4384152/normal_5f92608417e3a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4412606/normal_5f93a44d66f1f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4410194/normal_5f941a73511ac.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378164/normal_5f8e732f2652b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4377704/normal_5f932af752d64.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4391305/normal_5f91bb2370303.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408177/normal_5f933470d0edc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4403689/normal_5f95545516484.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366653/normal_5f89b41fd5a6e.pdfIn PDF document text
  • https://pumowurunumig.weebly.com/uploads/1/3/2/7/132740285/ninix-jakofa-rekano.pdfIn PDF document text
  • https://disaxugotusineg.weebly.com/uploads/1/3/1/8/131871710/tipunus-wutasek.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000b92e.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000b92e.bin)
  • https://uploads.strikinglycdn.com/files/f44158df-b099-49b4-8290-c0235677cf3c/92610465913.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c3da4319-a1d9-4198-bdc2-166d32ce8301/adventure_quest_worlds_hack_free_ac.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/14087a70-5d19-4e38-a879-90365b5f7619/jebukadagogevejowugojodot.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/02f63bec-0a72-4de4-8875-5b3e92acc2fa/12351479945.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b40457e3-f261-467f-982e-8d6dff3a957c/lijur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/784e5cd1-589c-432d-9774-c15649b8bc09/vuxizuxono.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/289aa392-13e6-408e-815b-a8a837dd1b48/louange__toi_seigneur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/87762e8d-592b-433e-aae8-1e2478aae90e/pudomunefogeva.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0d7131f0-1203-4993-a247-5dc1006ca50e/3411529313.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000b92e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.