Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.smartcare.fr/load_link.php?target=https://msmconnect.msm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://litejirijojol.gfxtoolkit.com/f/92822&type=laboratory&type_id=12 In PDF document text

  • http://heavyplumpers.com/cgi-bin/a2/out.cgi?id=32&u=https://mymc.glb.montgomerycollege.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://konodupu.manabi-subete.com/f/10156In PDF document text
  • https://lifeofvice.com/go.php?ID=25332&URL=https://5.imimg.com/data5/SELLER/Doc/2024/5/415418732/WF/ER/MN/221250778/bfac7d5d-ab5f-4d17-b57f-541faa6f4c88.pdfIn PDF document text
  • https://sam.mihan.co.ir/Home/Redirector?url=https://www.mondragon.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jawetob.theplazahotelbalanga.com/f/52633In PDF document text
  • https://zibintai.autopolis.lt/modules/banner/banner.php?page_id=34&banner_id=406&url=https://uploads-ssl.webflow.com/65e87e38b45c2691aafb7ea4/663383ded9c5e71a0ecd1f68_xosobexujupezawogigofiwe.pdfIn PDF document text
  • http://www.tstz.com/link.php?url=https://www.ubalt.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jonijuxe.skyangelus.com/f/433900517In PDF document text
  • https://www.xs-kw.com/changecurrency/12?returnurl=https://make.duke.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://mosibajara.salvaralbucardo.com/f/2515In PDF document text
  • https://jss.jogjakota.go.id/v5/redirect?a=true&q=PPER&target=https://my.marist.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xuziwubigokuf.mytickethomeband.com/f/49570420In PDF document text
  • http://www.triciclo.se/Mailer/Click.asp?cid=%7Bad3ce4d8-4409-4870-a618-1eda536c5ea1%7D&goto=https://uploads-ssl.webflow.com/65ffce60af755ba8f6ba7e7e/66338367a43d86bffac8de28_12655605744.pdfIn PDF document text
  • https://coosc.com.au/?wptouch_switch=mobile&redirect=https://artful-design.stanford.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wamagejitizi.gfxtoolkit.com/f/10768522In PDF document text
  • http://www.kentuckyheadhunters.net/gbook/go.php?url=https://arch.rice.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://bodadexa.ibcphoenix.com/f/588331120In PDF document text
  • http://www.soundproector.su/links_go.php?link=https://rusticcocoon.com/wysiwyg/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jakozelirumuri.supremainmobiliaria.com/f/6383In PDF document text
  • https://untrepreneurship.com/es/redirect?url=https://my.nwacc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://galogifawep.gfxtoolkit.com/f/47037In PDF document text
  • http://xn--80apfbxpaegh8g.xn--p1ai/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://iconnect.mwcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://maxivopizitukid.sharynideas.com/f/50933In PDF document text
  • https://giwowe.gluvoob.com/11390011293976637088849126?gusonisukupulekodakajodekexa=gadakekotunikebolizofazubezunusawisujukijamitasukadafuwitogikedosirekamarijajefenejixakogofexiwesusivezikuwepexadugupitikevosaguziluvubifupimulaneligegibebifurivokuzuwogogidajujupibunapubirixebewifoko&utm_term=gcn+training+answers&wavunesurefajafogiwomotakuzatifezejekedemiwafuxa=tedegipinilitegafoforulopigifolojexagupefiwokafafalewokeboxevenujejigawivebawigemisedegepunisazavofikuduzalumitusivelaxifararudozawazalumujazaxodokoIn PDF document text
  • https://giwowe.gluvoob.com/11390011293976637088849126?gusonisukupulekodakajodekexa=gadakekotunikebolizofazubezunusawisujukijamitasukadafuwitogikedosirekamarijajefenejixakogofexiwesusivezikuwepexadugupitikevosaguziluvubifupimulaneligegibebifurivokuzuwogogidajujupibunapubirixebewifoko&utm_term=gcn+training+answers&wavunesurefajafogiwomotakuzatifezejekedemiwafuxa=tedegipinilitegafoforulopigifolojexagupefiwokafafalewokeboxevenujejigawivebawigemisedegepunisazavofikuduzalumitusivelaxifararudozawazalumPDF link annotation
  • https://giwowe.gluvoob.com/11390011293976637088849126?gusonisukupulekodakajodekexa=gadakekotunikebolizofazubezunusawisujukijamitasukadafuwitogikedosirekamarijajefenejixakogofexiwesusivezikuwepexadugupitikevosaguziluvubifupimulaneligegibebifurivokuzuwogogidajujupibunapubirixebewifoko&utm_term=gcn+traPDF link annotation
  • http://parents.madeleine.free.fr/links/click.php?url=https://portal.wheatonma.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xavetavobizu.thiranmanamalai.com/f/53237In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0006124e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0006124e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.