Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lazav.co.za/XSRYdR1H?utm_term=aha+stroke+secondary+prevention+guidelines+2018 PDF link annotation

  • http://prunay-en-yvelines.fr/ckfinder/userfiles/files/nexunuja.pdfIn PDF document text
  • http://clubsahdianagalati.ro/upload/editor/file/62337988674.pdfIn PDF document text
  • https://orsam.org.tr/paketler/ckfinder/dosyalar/files/mapifan.pdfIn PDF document text
  • https://ijieet.org/ckfinder/userfiles/files/50496437150.pdfIn PDF document text
  • http://color-gateway.com/userfiles/file/44758527746.pdfIn PDF document text
  • https://anfauglir.com/images/file/50306058867.pdfIn PDF document text
  • http://npas.ru/pic/file/5393913227.pdfIn PDF document text
  • http://nwatchonline.info/userfiles/file/fuzapawo.pdfIn PDF document text
  • https://adepotcustom.com/UploadFiles/file/20211119162229105.pdfIn PDF document text
  • https://luminex.pl/upload/file/zigarulajidibok.pdfIn PDF document text
  • http://cnzgks.com/userfiles/file///kedewekulikikitenubipaw.pdfIn PDF document text
  • http://vuadiemtayninh.com/hinhanh_fckeditor/file/ririle.pdfIn PDF document text
  • https://www.jaegeraviation.com/ckfinder/userfiles/files/48353988378.pdfIn PDF document text
  • https://processwork.archerhuang.com/ConImg/files/50102393571.pdfIn PDF document text
  • https://intervalhousehamilton.org/ckfinder/userfiles/files/retanexerurujenexedajewo.pdfIn PDF document text
  • https://pointswestliving.com/ckfinder/userfiles/files/juronojamerexugos.pdfIn PDF document text
  • http://letresorellebio.it/userfiles/files/14967224172.pdfIn PDF document text
  • http://sladkiy-ostrov.ru/userfiles/files/fapudofunurexuvevefi.pdfIn PDF document text
  • http://deccanquest.com/konadnew/userfiles/file/5763826019.pdfIn PDF document text
  • http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/161587b07c70be---wizoxerusiju.pdfIn PDF document text
  • http://goodfortune.hk/UpLoadFile/file///75490440364.pdfIn PDF document text
  • http://movietek.vn/hinh-anh/files/28865997534.pdfIn PDF document text
  • http://theshop24.com/userfiles/file/86290316480.pdfIn PDF document text
  • http://allycatering.com/userfiles/32960062194.pdfIn PDF document text
  • http://zeroschem.com/upload/fck/file/6478128413.pdfIn PDF document text
  • http://autord.ca/site-uploads/tativuribonarode.pdfIn PDF document text
  • https://marathonblainville.com/userfiles/files/zufus.pdfIn PDF document text
  • http://oppedisanorobertosrl.com/userfiles/files/32371088870.pdfIn PDF document text
  • http://akinmobilyavedekorasyon.com/app/webroot/kcfinder/upload/files/gemenisib.pdfIn PDF document text
  • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/161afe80b41258---rozanezagenajagutotizotur.pdfIn PDF document text
  • https://www.csorog.hu/kcfinder/upload/files/lorusoxevepevafur.pdfIn PDF document text
  • https://datatech-int.com/userfiles/file/96743399209.pdfIn PDF document text
  • http://doicoffee.co.jp/js/kcfinder/upload/files/migagesoxo.pdfIn PDF document text
  • https://viajespereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a53c017f435---55959510905.pdfIn PDF document text
  • http://ovstav.cz/app/webroot/files/files/putubepativonufuvetopos.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000571e3.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000571e3.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.