Malicious PDF / .VIR — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://omsk.magazin-bezhimii.ru/get_url.php?url=https://parlab.eecs.berkeley.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zojemumobekol.thiranmanamalai.com/f/44964957 In PDF document text

  • https://www.uwtuinendier.com/winkelmandje/landkeuze/fr?redirect=https://newmediadl.cas.msu.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fanudimowitaze.sharynideas.com/f/60351325In PDF document text
  • https://kinhtenongthon.vn/ClickAd.aspx?IDAD=35&col=T3&Zone=2&Urlad=https://radlab.cs.berkeley.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sisizunepejade.skyangelus.com/f/50765In PDF document text
  • http://www.search.searchtsbn.com/home/click?uc=17700101&ap=&source=&uid=fa309cab-10e4-4b88-98c2-8a9f30a55fcc&i_id=&cid=&url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415154440/SJ/SD/VJ/221167405/37196855294.pdf&value=toolbar_cnn_newsoutletIn PDF document text
  • http://ru.freewifi.byte4b.com/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://ucsolar.ucmerced.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lalivu.sentineltr.com/f/9057In PDF document text
  • https://synology-store.ru/bitrix/rk.php?goto=https://assets.website-files.com/65f03c438efea1c906590ffe/66326d6431bc99b4e3557974_rivofubuporifakowix.pdfIn PDF document text
  • http://www.webportal.com.my/download/download.asp?File=https://odlingfamily.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://tobakusuto.supremainmobiliaria.com/f/1489211In PDF document text
  • http://setraki5.ru/bitrix/rk.php?id=17&site_id=s1&event1=banner&event2=click&goto=https://nabil-doukali.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zipep.supremainmobiliaria.com/f/76272In PDF document text
  • http://isolatieoffertes.vlaanderen/https://norikura-inter.com/common/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://virubelesux.theplazahotelbalanga.com/f/64461In PDF document text
  • https://shopmagazine.jp/magazine/redirect/256/?slug=57851&url=https://www.kickstandbikeshop.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://dalali.sharynideas.com/f/80459411&scid=rm_110068In PDF document text
  • https://english.socismr.com/bitrix/redirect.php?goto=https://mypima-stage.pima.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fuwikoneva.sharynideas.com/f/98406771In PDF document text
  • https://searchglnpro.com/home/click?uc=17700101&ap=&source=&uid=6df92d71-67ce-41c6-8214-228a3f7f7e35&i_id=&cid=&url=https://assets.website-files.com/65ffcc785ca456b046626e18/66327b2769700b8494a58e8b_17575460433.pdf&value=toolbar_cnn_newsoutletIn PDF document text
  • http://www.rcscuola.it/ufficio/adredir.asp?url=https://uploads-ssl.webflow.com/660026cefdfbc3c2ddd6b13b/66326f4a7bd61c83c895a3d9_97389458748.pdfIn PDF document text
  • https://www.dealighted.com/clicks.php?id=44943074&url=https://myuagm.uagm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wolerojujiv.theplazahotelbalanga.com/f/6200In PDF document text
  • http://www.fsg-zihlschlacht.ch/sponsoren/sponsoren-weiter.asp?name=RaiffeisenbankZihlschlacht-Muolen-Bischofszell&url=https://mybusinessdev.fiu.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://burowozageva.skyangelus.com/f/81653804In PDF document text
  • https://www.labnews.co.uk/track-url?url=https://assets.website-files.com/65f025e065f81cc9e74cd611/663269b9d1f8bf96a414c604_31444585025.pdf&article=2030635In PDF document text
  • http://www.afada.org/index.php?modulo=6&q=https://pages.uwf.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lukux.thiranmanamalai.com/f/679213240&BaID=1In PDF document text
  • http://ladyboysurprises.com/cgi-bin/at3/out.cgi?trade=https://mypima-stage.pima.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rezida.thiranmanamalai.com/f/67001075In PDF document text
  • https://www.porno24.su/xxx.php?link=video-bookmark&skip_sell=true&url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415148407/ZP/HN/TO/221167159/aecaad93-960f-4b67-a36f-40c0435e8846.pdfIn PDF document text
  • http://guiaosorno.com/face.php?id=372&face=https://uploads-ssl.webflow.com/65dcbc734bdcd373b59c9554/663278dee99df866ec1cb3a1_vozubikibolafogarubikib.pdfIn PDF document text
  • https://myr.registercentrum.se/download?fileUrl=https://myconnect.waynesburg.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fivizoji.gmcalaya.com/f/46508298In PDF document text
  • https://newsformat.jp/ohmygod/?u=https://assets.website-files.com/6600191852db2e4c088b1a48/66327102c075b020380c786d_gabulubepud.pdf&c=dWEnT/p7EOHoI&i=3&seq=&taf=In PDF document text
  • http://www.avto-book.ru/go_web.php?web=https://assets.website-files.com/65dcb13405addd8698f4ddb2/663272842e2b4b02e900a8ae_42299174835.pdfIn PDF document text
  • https://peercise.com/ref/https://info.accs.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://nutubodepekade.gmcalaya.com/f/38316In PDF document text
  • https://prettysix.com/appredirect.php?link=https://5.imimg.com/data5/SELLER/Doc/2024/5/415153317/OO/IM/RM/221169458/b3772408-9286-480b-9d55-5ac5e004c7b9.pdfIn PDF document text
  • https://miloserdie.help/bitrix/redirect.php?goto=https://uploads-ssl.webflow.com/66003084120ce91830d50505/66326518c91d02733ecdae69_jidanodozirupunif.pdfIn PDF document text
  • https://click.linktrack.co.nz/C5PWF/756J89/?url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415155617/OR/NB/FI/221167355/b115123f-dcd7-4258-8c67-16690e19397f.pdfIn PDF document text
  • https://revive.goryiludzie.pl/www/dvr/aklik.php?ct=1&oaparams=2__bannerid=132__zoneid=18__cb=42201a82a3__oadest=https://portal.uas.alaska.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wozid.ibcphoenix.com/f/44556In PDF document text
  • https://rankmyagent.com/brennanzurowski/out?url=https://assets.website-files.com/65dcc6d1d1094375c204a682/66326b6204f88efb1433e291_wozerewan.pdf&type=socialIn PDF document text
  • http://raovatorangecounty.com/chuyen-trang-url/https://uploads-ssl.webflow.com/65dc8f6b008098122e440156/663277cada60de419f32a5bb_44586176700.pdfIn PDF document text
  • https://avvocati.it/go?url=https://ohiotech.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xisifexutad.gfxtoolkit.com/f/15292141In PDF document text
  • http://matureporngalleries.xyz/out.php?link=images/6x17x183583&group=main&p=s1&link2=th&url=https://assets.website-files.com/65f00cbde4a111637cb02c22/663271971e89f12e65e4d556_76257009572.pdfIn PDF document text
  • https://starkhardenberg.nl/redirect.php?url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415148237/TY/OT/ZC/221167355/078fe97f-c4ab-49d2-b19b-7d2b108b5984.pdfIn PDF document text
  • https://www.hfmmagazine.com/user/logout?referer=https://make.duke.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://weperenozowip.salvaralbucardo.com/f/653419239In PDF document text
  • https://extempore.info/online-exhibitions/redirect/?block_id=6&stand_id=2822&exhib_id=0&link=https://iconnect.mwcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fujakiromoku.supremainmobiliaria.com/f/24749147In PDF document text
  • https://modaengafas.com/ads/huellas?url=https://apollos.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://memen.mytickethomeband.com/f/90666In PDF document text
  • https://www.guiasetelagoas.com/acesso_banner.php?tipo=4&id_banner=2&link_banner=https://my.canisius.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fenasofop.gfxtoolkit.com/f/95509In PDF document text
  • https://rirat.mifuj.co.za/55796859327088531676666194?bakemivaxagevakupavufovokebukijavejelovofogawezigeliwezizekigalakiravuzesoxurikasupokabimelamori=didavufigimasovapuvukolutobutejatedumejexikufokevabomadogubipiritebakalodizafubinolokixilirimawozeletomukujuzotuzotajironuvivegadimarederewujegipegawazerebomorividibatovulifujesudorimivoxetaxovimuwasowagov&utm_kwd=domain+range+practice&tavidadobubizeweridujitosutisibuvamekubedobenezipoxaniniwosewux=zeridozolaronegexolabizinutaximolixubezojilejowademufozopejemetamawimipitawigotatamenaveputoxawadelarugogoxenufoveduxonIn PDF document text
  • http://www.global56.com/cn/Korea/gotourl.asp?urlid=https://mdphd.ouhsc.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wizaf.supremainmobiliaria.com/f/49240365In PDF document text
  • https://rirat.mifuj.co.za/55796859327088531676666194?bakemivaxagevakupavufovokebukijavejelovofogawezigeliwezizekigalakiravuzesoxurikasupokabimelamori=didavufigimasovapuvukolutobutejatedumejexikufokevabomadogubipiritebakalodizafubinolokixilirimawozeletomukujuzotuzotajironuvivegadimarederewujegipegawazerebomorividibatovulifujesudorimivoxetaxovimuwasowagov&utm_kwd=domain+range+practice&tavidadobubizeweridujitosutisibuvamekubedobenezipoxaniniwosewux=zeridozolaronegexolabizinutaximolixubezojilejowadePDF link annotation
  • http://www.pref.rs.ba/Home/SetCulture?code=en-US&redirectTo=https://lovemyyacht.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jafavazimube.gfxtoolkit.com/f/75752169In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
  • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
  • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
  • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
  • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
  • http://ns.adobe.com/xap/1.0/rights/Referenced by PDF JavaScript
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0006533e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0006533e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.