Malicious PDF / .VIR — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://milfgals.net/cgi-bin/out/out.cgi?rtt=1&c=1&s=55&u=https://assets.website-files.com/660032d3ebd7404f85483604/663244a3050358585ecdee73_vofukofowovodemimamele.pdf In PDF document text

  • https://www.netzwerk-kinderrechte.ch/newsletter/countlinks.php?uri=https://intl.seattlecentral.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fidofo.club-directory.com/f/948044129&nid=15&did=In PDF document text
  • http://www.everyzone.com/log/lnk.asp?tid=web_log&adid=95&url=https://chesapeakebay.umd.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lirakamibol.gfxtoolkit.com/f/21910In PDF document text
  • https://quimacova.org/proveedores/public/ir?id=72&publ=1&url=https://bscintra.buffalostate.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://marar.manabi-subete.com/f/5868In PDF document text
  • http://library.apecschools.edu.ph/cgi-bin/koha/tracklinks.pl?uri=https://uploads-ssl.webflow.com/65effb28668f8b813e06faaf/6632518e47b918a049c99567_78574702712.pdf&biblionumber=159In PDF document text
  • http://rebill.me/go.php?url=https://ohiotech.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://saletisotojaze.palsaikbbq.com/f/536751885In PDF document text
  • http://tikhomirov-music.com/language/en_US?page=https://vlab.amrita.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://muxediwitaju.theplazahotelbalanga.com/f/18227In PDF document text
  • http://www.doctor-navi.com/sos/cgi/acceess-ranklink/naika/ranklink.cgi?action=jump&id=memezawa&url=https://oldsoultattoo.com/includes/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gixanu.palsaikbbq.com/f/63157676In PDF document text
  • http://panasonicnotebook.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://my.sunysuffolk.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gusimew.mytickethomeband.com/f/15078548In PDF document text
  • https://vn44.ru/site/away.html?url=https://myportal.cccs.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jejarejufume.sharynideas.com/f/226063911In PDF document text
  • https://www.ural56.ru/bitrix/redirect.php?goto=https://uploads-ssl.webflow.com/65f03c81ffe00f8469a54fbc/66325367d1fd280306c77416_5154083402.pdfIn PDF document text
  • https://mereba.xeltuve.com/89958609691705678514871640?tefuxurekililukutoruvidimufipatubuzejenukulozupakujinupokogopuxolibi=ponodefiwuraxoritivurorerowuniriwiboxopudabudigagitipalibadizenupudivipepuzasubepewozapibuwefamilivuzitamiwexuzupekonuwamavodazuvamatefewuvazipaliwevuxakujakukunuzesogodufiwevidixogafabutujavumononenuwaji&utm_kwd=harry+potter+potion+labels+printable&sikabuwemimipovakewepebolajawitimikot=lufekeladovijegupenifasuzizurotitatazadewigokurulumogatawafemukamulevanuniguvumunifutulenelatuxurezufonuzewobibowexomusuzagalixodawojexaboduzemufizamIn PDF document text
  • http://www.tgphunter.net/tgp/click.php?id=382643&u=https://connect.cuchicago.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pinonumixugol.thiranmanamalai.com/f/587576108In PDF document text
  • https://mereba.xeltuve.com/89958609691705678514871640?tefuxurekililukutoruvidimufipatubuzejenukulozupakujinupokogopuxolibi=ponodefiwuraxoritivurorerowuniriwiboxopudabudigagitipalibadizenupudivipepuzasubepewozapibuwefamilivuzitamiwexuzupekonuwamavodazuvamatefewuvazipaliwevuxakujakukunuzesogodufiwevidixogafabutujavumononenuwaji&utm_kwd=harry+potter+potion+labels+printable&sikabuwemimipovakewepebolajawitimikot=lufekeladovijegupenifasuzizurotitatazadewigokurulumogatawafemukamulevanuniguvumunifutulenPDF link annotation
  • https://www.careers24.com/VacancyApplication/ExternalApplication/1688790?appResponseMethodId=2&applicationUrl=https://my.gadsdenstate.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://mutagipuxen.thiranmanamalai.com/f/293514776&utm_campaign=atsintegration&utm_medium=webIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000cd233.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000cd233.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.