Malicious PDF / .VIR — malware analysis report

Heuristics 4

• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://adservice.google.com.af/ddm/clk/448794861;252804937;a;;%3F//programme-push-pull-legs-pdf.xetedate.sbs/745.pdf In PDF document text

  • https://computer-networks-tanenbaum-4th-edition.pabojanob.cfd/dubin.pdfIn PDF document text
  • https://interpretacion-del-test-del-arbol-pdf.naturemultimedia.com/370.pdfIn PDF document text
  • https://adservice.google.co.ls/ddm/clk/466651624;272226156;i;;%3F//rirupav.rupesutit.cfd/setilinu.pdfIn PDF document text
  • https://wasojaxide.homerepairs-ren.com/38.pdfIn PDF document text
  • https://images-of-the-perineum.mumarapoba.sbs/1206496.pdfIn PDF document text
  • https://adservice.google.com.et/ddm/clk/424929466;226923624;r;;%3F//zozitazedas.besisoma.cfd/duduwepe.pdfIn PDF document text
  • https://dirt-estimation-chart-pdf.nhlbi-proteomics.org/guvikade.pdfIn PDF document text
  • https://june-first-jennifer-hartmann-pdf.fuzepomab.sbs/wakakedoguvulazur.pdfIn PDF document text
  • https://thor-comic-espa-ol-pdf.jifidez.sbs/8916703.pdfIn PDF document text
  • https://edital-perito-criminal-go-pdf.bumugigur.sbs/785.pdfIn PDF document text
  • https://direito-previdenci-rio-inss-pdf.ramadainnsiliconvalley.com/902.pdfIn PDF document text
  • https://sazikezomoma.evileyecharm.com/mogajixodijax.pdfIn PDF document text
  • https://parapro-assessment-study-guide-2018-pdf.fijavokug.cfd/jeguw.pdfIn PDF document text
  • https://linear-algebra-done-right-sheldon-axler.gotogev.cfd/8504865.pdfIn PDF document text
  • https://casa-de-oracion-radio.freedive-leipzig.de/700.pdfIn PDF document text
  • https://wooldridge-introductory-econometrics-5th.giramif.cfd/467.pdfIn PDF document text
  • https://adservice.google.com.ph/ddm/clk/478229754;284365575;c;;%3F//teresa-la-dart-lover-book.gunubiguf.cfd/26.pdfPDF link annotation
  • https://remuvijixij.bufomevaja.online/5573329.pdfIn PDF document text
  • https://adservice.google.co.th/ddm/clk/425484003;227454619;f;;%3F//campbell-biology-in-focus-study-guide-pd.poxutakima.online/vowezoburiv.pdfIn PDF document text
  • https://adservice.google.iq/ddm/clk/466651624;272226156;i;;%3F//luwodinaxu.raregamestore.com/wijodizirox.pdfIn PDF document text
  • https://adservice.google.co.jp/ddm/clk/426382440;228185261;d;;%3F//xamijeme.nazakux.sbs/fekenufujuxobewere.pdfIn PDF document text
  • https://adservice.google.hr/ddm/clk/408533097;208818505;l;;%3F//tusuvem.greatgiftsandtoys.com/sunam.pdfIn PDF document text
  • https://adservice.google.tl/ddm/clk/408533097;208818505;l;;%3F//piedmont-region-in-ga.mikefrazier4homes.com/jozaluxuvetupipe.pdfIn PDF document text
  • https://adservice.google.am/ddm/clk/445204615;249060672;c;;%3F//hopes-and-dreams-worksheet-pdf.pabarum.cfd/notezigafalejok.pdfIn PDF document text
  • https://adservice.google.pt/ddm/clk/445204615;249060672;c;;%3F//edital-perito-criminal-es-pdf.jumoxenaf.cfd/toned.pdfIn PDF document text
  • https://adservice.google.ci/ddm/clk/424929466;226923624;r;;%3F//effective-pandas-matt-harrison-pdf-free.biwesimu.cfd/88.pdfIn PDF document text
  • https://adservice.google.dm/ddm/clk/300948314;127869103;e;;%3F//diwosisiguz.bando47.de/kajilatepodixafe.pdfIn PDF document text
  • https://adservice.google.es/ddm/clk/295204063;122181591;w;;%3F//inside-out-workbook-pdf.davidsaffir.com/526401222.pdfIn PDF document text
  • https://adservice.google.cz/ddm/clk/448794861;252804937;a;;%3F//nimalasevesu.wititafaw.cfd/sumutoxozopibu.pdfIn PDF document text
  • https://adservice.google.cf/ddm/clk/425484003;227454619;f;;%3F//world-civilization-the-global-experience.kafemegi.cfd/vavareritux.pdfIn PDF document text
  • https://adservice.google.nr/ddm/clk/448794861;252804937;a;;%3F//m-cheyne-reading-plan-pdf.fopuduloz.cfd/98.pdfIn PDF document text
  • https://adservice.google.mn/ddm/clk/408533097;208818505;l;;%3F//ingenieria-constitucional-comparada-giov.zadisiw.cfd/651.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007678b.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007678b.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.