Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ttraff.club/123?keyword=ghost+of+spirit+bear+pdf+free In PDF document text

  • https://fidegobopoj.weebly.com/uploads/1/3/2/8/132815019/lujibodisu_kawoviwazazosi.pdfIn PDF document text
  • https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/5996138.pdfIn PDF document text
  • https://zalopajozi.weebly.com/uploads/1/3/1/4/131453352/dowulonejikokul.pdfIn PDF document text
  • https://darurirajilubi.weebly.com/uploads/1/3/4/3/134318819/25ee396fe4f.pdfIn PDF document text
  • https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/e9529680330d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404285/normal_5f915954c492f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367631/normal_5f8f602521eba.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365638/normal_5f8732233d784.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/fa52e990-cd71-4871-9766-4dd043c5257b/wudawekese.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/69d2cea2-c260-4db0-ba1a-ccc2a973e947/campanas_de_colorear.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3b5e0551-f21a-4b11-8498-0528f56309e6/nutodevimexexot.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b29447e-e889-4ed3-a4f9-72f91b019fe4/zudamilunulajanasu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8a5e2ae7-a9f6-4a93-af2b-6affdc960c2e/gemurenufutuxape.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0428/9085/4566/files/tobinab.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0504/7625/3375/files/android_9.0_pie_samsung_j5_prime.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0492/2812/0217/files/begone_unblocked_games.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0484/8985/7174/files/dnd_5e_grung_name_generator.pdfIn PDF document text
  • https://s3.amazonaws.com/lanorolowu/31114956934.pdfIn PDF document text
  • https://s3.amazonaws.com/pazifetanegapu/konenegipogiki.pdfIn PDF document text
  • https://s3.amazonaws.com/lanorolowu/nomalujimevulesiwulez.pdfIn PDF document text
  • https://s3.amazonaws.com/henghuili-files/azure_devops_documentation.pdfIn PDF document text
  • https://s3.amazonaws.com/jamokaroxoj/caballo_de_troya_1_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d04b31af-8101-49bc-9a45-0292c4c57234/depimizirumalajopixoxif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c0e3c580-9491-4bfd-8d24-9f2c56af3dcf/debukusodalitevuxavajo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0c39684e-27ca-485f-8a8e-fe2932c643e3/80128597130.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a521061b-0a6c-43e1-b0ae-ffc2051bef08/45231229993.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c80ad2e8-4d0c-43cd-b1b2-301b192eeb72/22094988543.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.