Malicious PDF / .VIR — malware analysis report

Heuristics 4

• PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
  PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://adservice.google.com.pr/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/f1213013-d687-4ab5-be93-ecb862f9a32b/downloads/5605084803.pdf In PDF document text

  • https://adservice.google.com.ar/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/441e31fd-ec30-49a3-bdbd-0b56c9f02215/downloads/45331168990.pdfIn PDF document text
  • https://adservice.google.com.bn/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/d0d57707-0daa-4833-961a-c0d83409f6a0/downloads/22401347137.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/d0af96bd-1854-4a7e-891a-c1ae0e603c89/downloads/best_timetable_app_android.pdfIn PDF document text
  • https://adservice.google.kg/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/071bb9b8-ccbe-4368-b8b5-97f61b41a8a7/downloads/noterosasonobaberamexiko.pdfIn PDF document text
  • https://adservice.google.si/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/c73aa0c6-4d07-47a1-b625-965d8696c92f/downloads/ilauncher_apk_latest_version.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/19f93be4-b21c-4ca0-9d25-067f12cee00f/downloads/wk_3500_casio_manual.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/d4aec436-3b7a-4059-a57b-80be49a42db9/downloads/83072095248.pdfIn PDF document text
  • https://adservice.google.cn/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/071bb9b8-ccbe-4368-b8b5-97f61b41a8a7/downloads/fedirusajorajov.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/d0af96bd-1854-4a7e-891a-c1ae0e603c89/downloads/57967980155.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/5b52c4b7-51dd-42e7-95d2-174b99d7b6a2/downloads/mokid.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/87bb9607-47ba-4b41-9ed8-58f9bd791a52/downloads/point_of_view_graphic_organizer.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/c73aa0c6-4d07-47a1-b625-965d8696c92f/downloads/fuzedozunibiwiziziribo.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/00f82619-4ddf-4dd2-9f89-6f7c4705ed66/downloads/israel_travel_guide_video.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/d0af96bd-1854-4a7e-891a-c1ae0e603c89/downloads/19484329301.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/7bd63eb5-b690-44c1-81cc-d5dc166b50b7/downloads/kumegiwujosatirotiwixewo.pdfIn PDF document text
  • https://adservice.google.lk/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/d0d57707-0daa-4833-961a-c0d83409f6a0/downloads/tufubep.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/5b52c4b7-51dd-42e7-95d2-174b99d7b6a2/downloads/26482519863.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/d01f051d-8663-423a-97eb-1ab745e403e0/downloads/46742865103.pdfIn PDF document text
  • https://adservice.google.md/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/7bd63eb5-b690-44c1-81cc-d5dc166b50b7/downloads/jemekur.pdfPDF link annotation
  • https://img1.wsimg.com/blobby/go/7bd63eb5-b690-44c1-81cc-d5dc166b50b7/downloads/92852695270.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00072c46.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00072c46.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.