Malicious PDF / .VIR — malware analysis report

Heuristics 5

• QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LURE
  Document asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
• QR-code redirect lure medium SE_QR_LURE
  Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
• PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
  The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.mcnaar.net/ PDF link annotation

  • https://medicaid.afmc.org/In PDF document text
  • https://www.siteIn PDF document text
  • https://www.mcnaPDF link annotation
  • https://www.healthy.arkansasIn PDF document text
  • http://www.mcnaar.net/In PDF document text
  • https://www.deltadentalar.com/In PDF document text
  • https://www.arcf.org/our-impact/giving-tree/In PDF document text
  • https://www.uwcark.org/grantsIn PDF document text
  • https://uwseark.org/grant-applicationIn PDF document text
  • https://rvchristianclinicIn PDF document text
  • https://www.samcc.org/In PDF document text
  • https://www.welcomehealthnwa.org/In PDF document text
  • https://achi.net/In PDF document text
  • https://arkansas211.org/In PDF document text
  • https://www.aspirearkansas.org/In PDF document text
  • https://heartlandforward.org/In PDF document text
  • https://medicaid.afmcIn PDF document text
  • https://knowledge.nadp.org/research-articles-In PDF document text
  • https://humanservicesIn PDF document text
  • https://humanservices.arkansasIn PDF document text
  • https://achi.net/wp-content/In PDF document text
  • https://deltadentalsmiles.comIn PDF document text
  • https://www.mcnaar.netPDF link annotation
  • https://www.samccIn PDF document text
  • https://www.samcc.org/programs/In PDF document text
  • http://cipa.jp/exif/1.0/In PDF document text
  • http://prismstandard.org/namespaces/prismusagerights/2.1/In PDF document text
  • https://portal.mmis.arkansas.gov/In PDF document text
  • https://www.healthy.arkansas.gov/programs-services/In PDF document text
  • https://humanservices.arkansas.gov/In PDF document text
  • https://humanservices.arkansas.gov/divisions-shared-In PDF document text
  • https://ualr.edu/law/clinical-programs/legal-In PDF document text
  • https://ualr.edu/children/future-smiles-In PDF document text
  • https://humanservices.arkansas.gov/wp-In PDF document text
  • https://www.findhelp.org/In PDF document text
  • https://www.cdc.gov/oralhealthdata/index.htmlIn PDF document text
  • https://www.kff.org/other/state-In PDF document text
  • https://humanservices.arkansas.gov/divisions-In PDF document text
  • https://nppes.cms.hhs.gov/#/In PDF document text
  • https://www.healthy.arkansas.gov/images/uploads/In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/exif/1.0/aux/In PDF document text
  • http://ns.adobe.com/photoshop/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
  • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xmp/1.0/DynamicMedia/In PDF document text

  +12 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.