Malicious PDF / .VIR — malware analysis report

Heuristics 4

• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://adservice.google.com.gh/ddm/clk/300948314;127869103;e;;%3F//h-mos-sant-tableau-des-garanties-pdf.jalagaf.cfd/jalapavapekivenaf.pdf In PDF document text

  • https://bailey-stewart-leaked-onlyfans.imicconcepts.com/rami.pdfIn PDF document text
  • https://beatrice-zinker-guided-reading-level.whoreallywrotethebible.com/nemawajitibusaf.pdfIn PDF document text
  • https://2021-jeep-grand-cherokee-owner-s-manual.xivoful.cfd/83.pdfIn PDF document text
  • https://applied-statistics-for-engineers-and-sci.compuvend.com/731.pdfIn PDF document text
  • https://lettre-de-recours-gracieux-universit-pdf.nomunonuwe.cfd/605.pdfIn PDF document text
  • https://minecraft-de-pistoleros.nutedisu.cfd/798.pdfIn PDF document text
  • https://huawei-e5832-user-manual-pdf.nhlbi-proteomics.org/6993268.pdfIn PDF document text
  • https://adservice.google.com.ar/ddm/clk/448794861;252804937;a;;%3F//pdf-free-printable-rabies-certificate.imicconcepts.com/158005455.pdfIn PDF document text
  • https://fozemi.donatito.sbs/kezoluzugogapeteja.pdfIn PDF document text
  • https://adservice.google.com.gh/ddm/clk/426382440;228185261;d;;%3F//sexoxux.pizawax.cfd/rikomisuboruwujep.pdfIn PDF document text
  • https://diferencia-ventajas-y-desventajas-de-ins.nunofop.cfd/404.pdfIn PDF document text
  • https://adservice.google.bt/ddm/clk/408533097;208818505;l;;%3F//30-day-notice-to-vacate-ohio-pdf.tirisaxo.cfd/semexibixuvavujevof.pdfPDF link annotation
  • https://adservice.google.ci/ddm/clk/408533097;208818505;l;;%3F//sarovopij.lufibalore.sbs/81.pdfIn PDF document text
  • https://adservice.google.de/ddm/clk/425484003;227454619;f;;%3F//islands-near-florida-map.lunivus.cfd/lebofotolexuja.pdfIn PDF document text
  • https://adservice.google.lu/ddm/clk/466651624;272226156;i;;%3F//12-founding-families-of-new-mexico.bidunig.cfd/74.pdfIn PDF document text
  • https://adservice.google.li/ddm/clk/424929466;226923624;r;;%3F//manuale-dei-mostri-d.fuwepokeje.cfd/jadelawi.pdfIn PDF document text
  • https://adservice.google.hu/ddm/clk/300948314;127869103;e;;%3F//ranidi.gategozox.cfd/fezopepaxufebafufozi.pdfIn PDF document text
  • https://adservice.google.sn/ddm/clk/445204615;249060672;c;;%3F//zidesozazuga.mikefrazier4homes.com/159.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007659b.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007659b.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.