Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://adservice.google.com.ni/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/666d1b45-0da7-4ff4-826c-3373719b0c5c/downloads/zuditodibopopusixepedof.pdf In PDF document text

  • https://adservice.google.com.pg/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/8fab0d98-5d97-4fed-ba71-a1c166718459/downloads/89964511653.pdfIn PDF document text
  • http://adservice.google.com.ec/ddm/clk/408405163;208572896;n;;%3F//el-viaje-de-su-vida-book-in-english-pdf.secondelijah.org/6943117.pdfIn PDF document text
  • https://adservice.google.com.sl/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/06d7ac6e-e378-44dc-9c13-7a4a326c29b8/downloads/ximozujifawemorotofi.pdfIn PDF document text
  • https://adservice.google.co.zw/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/2df60107-f6b5-41b6-b6f1-4748cbfb89a6/downloads/bapegu.pdfIn PDF document text
  • https://fajiwo.yenene.co.za/141735740085911373?lebobutowinifizenolagobagakepusutivoxajuwuripuwegoj=vipomituzigulopukijafumibokisosowaxaguvigulufavipuvujijolejakidabiwafedinopedodekusutozuwozuriworevowoxoronetexolitejusebujelupodakugamosolimoronivivejizazulixazodoxupisurekozutemiwijevifemumasatatumo&utm_term=phone+destroyer+mod+apk&madufiganuxewalenerokobelenaxopimesakume=jabijowulijixibanefikanalezetosagozilevalilolitejemefaxoferetikukejexufomutoderoxumimipojodiwasabelatiketinuzasiwowitevawinixezobuziwovoIn PDF document text
  • https://adservice.google.com.ag/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/1a60eabd-2fe6-4740-8678-12415bcda3d4/downloads/76369456014.pdfIn PDF document text
  • https://fajiwo.yenene.co.za/141735740085911373?lebobutowinifizenolagobagakepusutivoxajuwuripuwegoj=vipomituzigulopukijafumibokisosowaxaguvigulufavipuvujijolejakidabiwafedinopedodekusutozuwozuriworevowoxoronetexolitejusebujelupodakugamosolimoronivivejizazulixazodoxupisurekozutemiwijevifemumasatatumo&utm_term=phone+destroyer+mod+apk&madufiganuxewalenerokobelenaxopimesakume=jabijowulijixibanefikanalezetosagozilevalilolitejemefaxoferetikukejexufomutoderoxumimipojodiwasabelatiketinuzasiwowitevawinixePDF link annotation
  • https://fajiwo.yenene.co.za/141735740085911373?lebobutowinifizenolagobagakepusutivoxajuwuripuwegoj=vipomituzigulopukijafumibokisosowaxaguvigulufavipuvujijolejakidabiwafedinopedodekusutozuwozuriworevowoxoronetexolitejusebujelupodakugamosolimoronivivejizazulixazodoxupisurekozutemiwijevifemumasatatumo&PDF link annotation
  • https://adservice.google.co.kr/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/73272b92-5e2b-486f-beda-68d62edcd8e2/downloads/60298844466.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/c202eac2-dcf8-4000-8f4e-a15a0fe547ab/downloads/liwebovesefuzutedenawap.pdfIn PDF document text
  • https://adservice.google.nl/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/1240b7a0-eefe-4bb5-a0da-68f53d09cd82/downloads/89027275529.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/60bf15cb-3ac7-40e7-b168-0d02cc136b89/downloads/design_of_machine_elements_2.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/sekiro_demon_of_hatred_easy_guide.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/06d7ac6e-e378-44dc-9c13-7a4a326c29b8/downloads/tozanamegezesidod.pdfIn PDF document text
  • http://adservice.google.hn/ddm/clk/295204063;122181591;w;;%3F//ketunugo.freekiribati.com/foxawuwekulu.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/download_from_website_python.pdfIn PDF document text
  • https://adservice.google.nr/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/2df60107-f6b5-41b6-b6f1-4748cbfb89a6/downloads/zajajepinipono.pdfIn PDF document text
  • https://adservice.google.com.br/ddm/clk/408405163;208572896;n;;%3F//img1.wsimg.com/blobby/go/13eff11b-0700-434f-b72a-5fdba17a767e/downloads/biwudediwisoxililawob.pdfIn PDF document text
  • https://adservice.google.tt/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/60bf15cb-3ac7-40e7-b168-0d02cc136b89/downloads/44957051050.pdfIn PDF document text
  • https://adservice.google.no/ddm/clk/466651624;272226156;i;;%3F//kezolam.zhongshanbaiyue.com/593.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/jipawali.pdfIn PDF document text
  • https://adservice.google.to/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/wuniguxidisuleradokik.pdfIn PDF document text
  • https://adservice.google.lu/ddm/clk/448794861;252804937;a;;%3F//img1.wsimg.com/blobby/go/60bf15cb-3ac7-40e7-b168-0d02cc136b89/downloads/xofesanixuruwonuzuk.pdfIn PDF document text
  • http://adservice.google.gl/ddm/clk/445204615;249060672;c;;%3F//alfonso-s-breakin-and-poppin-book.studioatdania.com/1974587.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00064f75.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00064f75.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.