Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.agriturismo-italy.it/gosito.php?nomesito=https://uploads-ssl.webflow.com/65dcbba9b58d3ce7f29747f1/66321f87c4b25554caf4ba84_63653088699.pdf&idagri=3455&possito=1098 In PDF document text

  • https://www.ronl.org/redirect?url=https://campus.murraystate.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zuzigukozose.club-directory.com/f/67816149In PDF document text
  • http://www.accountingsoftware411.com/Advertising/adredirector.aspx?adid=57&keyword=&pageloc=http://www.accountingsoftware411.com:81/ConsultantDirectory/consultantview.aspx?cid=Infi67A126c&type=C&target=https://uploads-ssl.webflow.com/65ffe47c7523e33dfa830a10/663225f3ce51b39cdb65dd67_jilixovozowuja.pdf&custid=Infi67A126cIn PDF document text
  • https://www.c20.com.br/banner.php?id=2&link=https://assets.website-files.com/65f0406cafef9d68074a5137/6632275f34a25cb719a5e2a8_rapumo.pdfIn PDF document text
  • https://freexxx18.net/xxx.php?link=video&p=100&u=https://iet-co.net/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://tipaf.club-directory.com/f/43791In PDF document text
  • http://auto-accent.ru/go/url=https://uploads-ssl.webflow.com/660006a952db2e4c087d6d60/66321fac93100e5962864cb8_ruzavolalojenimazekepu.pdfIn PDF document text
  • http://xhmjdec.com/web/showvr.php?id=38&url=https://activity.scar.gmu.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://voxepazu.manabi-subete.com/f/740012086In PDF document text
  • http://kushnareva.ru/bitrix/redirect.php?goto=https://my.curry.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://bajovuxuvuv.mytickethomeband.com/f/30252733In PDF document text
  • http://shenqixiangsu.com/api/misc/links/redirect?url=https://assets.website-files.com/65dca0728fe3de07815cf0e4/663226a6c84041962bc943f9_bexuzituvifotopemoxovu.pdfIn PDF document text
  • http://raovatorangecounty.com/chuyen-trang-url/https://findadoc.uhmc.sunysb.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kumuraju.supremainmobiliaria.com/f/45497In PDF document text
  • http://www.diwaxx.ru/win/redir.php?redir=https://assets.website-files.com/65f004f91788edf39d5bdbbe/6632254b84ebf97e03336a1f_4815158351.pdfIn PDF document text
  • https://registercentrum.se/download?fileUrl=https://housecallbuddy.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sibasij.gmcalaya.com/f/71641149In PDF document text
  • https://capnexus.org/link_tracker/track?n=348&h=https://assets.website-files.com/65f02a12637d7f46293b10fd/663225000bf3a22cc54736bd_46925262614.pdfIn PDF document text
  • https://www.arlanza.com/es/bannerlink.asp?id=13&web=https://mybusinessdev.fiu.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://goseveni.thiranmanamalai.com/f/11097In PDF document text
  • http://feature.goo.ne.jp/redirect/brandear/d_ng/https://my.cfcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rotajopizoli.thiranmanamalai.com/f/30552779In PDF document text
  • https://www.wearn.com/ad_redirect/count.asp?url=https://my.cfcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://mepenuvez.palsaikbbq.com/f/60961In PDF document text
  • http://www.centrogdl.com/empresas_destacadas_redireccion.php?id_empresa=183&web=https://myuagm.uagm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://poreg.skyangelus.com/f/38067641In PDF document text
  • http://www.xn----y94f84i87n.com/shop/bannerhit.php?bn_id=22&url=https://assets.website-files.com/660019e3e3b61b1d729bf0cc/6632219502c58530931e0900_bimezeverilubijoz.pdfIn PDF document text
  • http://www.plantplaces.com/perl/viewads.pl?source=usindexlink&destination=https://5.imimg.com/data5/SELLER/Doc/2024/5/415097948/WP/AQ/NG/221169569/jenijaxi.pdfIn PDF document text
  • https://leclerc.com.pl/banner/3632?redirect=https://uploads-ssl.webflow.com/65f02ea454bc714a1644fbe3/663224fbc84041962bc7d4f7_52245496141.pdfIn PDF document text
  • https://www.clc.cat/modular-nl.php?url=https://artful-design.stanford.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kekobetobokos.gfxtoolkit.com/f/4814&fk=&email=In PDF document text
  • http://zebraprint.ru/go/url=https://radiancesolutionz.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://didisegeve.thiranmanamalai.com/f/77838In PDF document text
  • https://www.shopk.com/redirect?url=https://cast.ucmerced.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://petixixema.mytickethomeband.com/f/54353025In PDF document text
  • http://17ll.com/apply/tourl/?url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415104707/AW/HT/ZY/221169174/9ed4676d-95b7-4c0c-87fa-8ffb2ba2196a.pdfIn PDF document text
  • http://brief.promax.org/revive/www/delivery/ck.php?ct=1&oaparams=2__bannerid=99__zoneid=3__cb=04a8d0f9ed__oadest=https://www.ohiotech.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gununoromuvufi.club-directory.com/f/11148In PDF document text
  • http://support.magnaflow.com/trackonlinestore.asp?storename=https://uploads-ssl.webflow.com/660037bdb967491a9dc98139/663226feb5a60693ff3ca95a_93445399694.pdfIn PDF document text
  • http://www.ra2d.com/directory/redirect.asp?id=1053&url=https://uploads-ssl.webflow.com/660044b783c3b0122ac4f029/66322a3b516544ad2f8ebd69_kajew.pdfIn PDF document text
  • https://www.elmarket.by/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://themis.mars.asu.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://tokazed.skyangelus.com/f/615381543In PDF document text
  • https://testing.sopjh.ch/redirect-forward.php?ste=2245&url=https://uploads-ssl.webflow.com/65f00856e35eedcbc9cc7299/663229a484ffc8297ddc97b3_lexebojonivamop.pdfIn PDF document text
  • http://www.godoor.com/search/gotourl.asp?url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415100206/SA/SG/XK/221169561/rikubujivili.pdf&id=347In PDF document text
  • http://drawschool.ru/go/url=https://uploads-ssl.webflow.com/65dc9b6a213ee930bca2175f/6632287488db562548e49e60_19719620206.pdfIn PDF document text
  • https://gsmclinic.be/https://ucsolar.ucmerced.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fimekarew.supremainmobiliaria.com/f/72520900In PDF document text
  • https://www.google.co.ke/travel/clk?pc=AA80OsxS4aXr3v0H_f1c6auITW2co6VzLg4bZn6fbk8SfDqI-PBIwBHbD6EwWA3x7j0GSMYfW22yvJRcIK4JTSDL7HSAUj8GRnxrxhBIJlDredUX9QT8RQK28qrr2tG0UCJGis9nHQ&pcurl=https://arch.rice.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jubotowo.sentineltr.com/f/68285888&ap=1In PDF document text
  • http://www.xxx-cartoon.net/cgi-bin/tss/out.cgi?u=https://nest.montclair.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sagasodoji.gfxtoolkit.com/f/49431920In PDF document text
  • https://topoptics.ru/bitrix/redirect.php?goto=https://assets.website-files.com/65dcbc3a1710405f6e0cfee2/66322477d21d6790591769f8_xapezi.pdf&url=http://tn.heldforranson.com/3633-description-and-characteristics-of-the-pear-variety-f.htmlIn PDF document text
  • https://8teen.pro/xxx.php?link=video-bookmark&skip_sell=true&url=https://admissions.osu.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xalod.salvaralbucardo.com/f/93948845In PDF document text
  • https://kizadu.wirut.co.za/69302170830588321181524949?poluxabowapokudidakajoturapelelerunibefemururizowipobugugebunosuvekugakisivujagafebakanutiru=jixupofinimizudinuvofunesudusikudufixipesusanukakixoxefuxemadejosiwaxarebudogodozituzinofazamumikoxokuxatufoferevupusukuwolekadijazisejuwowuzuvufozabasilowewifidijazirerapopubisuxezujafadopezatajumawavev&keyword=teas+reading+practice+test+quizlet&gagakobuzazebapiwavarugajuvexinivilixiwusejexugudifivivofibilusafoluxujo=vefatuvezivoxaxuturefiposezetajozotolirigurebitivevesorixanunodusuxinulotemexutosekuvuzuxajifidikasonakobekenurukesemekuIn PDF document text
  • https://kizadu.wirut.co.za/69302170830588321181524949?poluxabowapokudidakajoturapelelerunibefemururizowipobugugebunosuvekugakisivujagafebakanutiru=jixupofinimizudinuvofunesudusikudufixipesusanukakixoxefuxemadejosiwaxarebudogodozituzinofazamumikoxokuxatufoferevupusukuwolekadijazisejuwowuzuvufozabasilowewifidijazirerapopubisuxezujafadopezatajumawavev&keyword=teas+reading+practice+test+quizlet&gagakobuzazebapiwavarugajuvexinivilixiwusejexugudifivivofibilusafoluxujo=vefatuvezivoxaxuturefiposezetajozPDF link annotation
  • https://kizadu.wirut.co.za/69302170830588321181524949?poluxabowapokudidakajoturapelelerunibefemururizowipobugugebunosuvekugakisivujagafebakanutiru=jixupofinimizudinuvofunesudusikudufixipesusanukakixoxefuxemadejosiwaxarebudogodozituzinofazamumikoxokuxatufoferevupusukuwolekadijazisejuwowuzuvufozabasilPDF link annotation
  • https://every-topics.blogsky.com/dailylink/?go=https://myuagm.uagm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://dolixu.sharynideas.com/f/52270734&id=3In PDF document text
  • https://dd.redeletras.com/show.link.php?url=https://uploads-ssl.webflow.com/66002f28ddd6593df703173c/66321f49896abef316ee9823_90205550743.pdfIn PDF document text
  • https://mathrbgroup.blogsky.com/dailylink/?go=https://uploads-ssl.webflow.com/65e888e162bc09d12ad326dc/663229539455a44b8bb5501c_rajatilito.pdf&id=118In PDF document text
  • https://basigsport.blogsky.com/dailylink/?go=https://uploads-ssl.webflow.com/65fffba8e2ebce24aaf30a21/663225d009d198461a940b86_pogemeratirarejopeferidaw.pdf&id=3In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000b6294.bin)

  +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.