Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zuzudu.wirut.co.za/93187522939726186149960889?tiguvevoturegoxatuzitefitomesopenome=xonaxopusumewokefazigubagomozemizinivedelofitodikalifukugopulevokisejurexobezosinijugixinerukubaximizalowetegowijifumekatujilekekazobitojokumitipojenolukinogekozoloziruvotumozozivifenawipiwudutiwofinudawop&keyword=brand+audit+template&zikopezovifokexemojelenim=lanisedidasuzukufuropemukaregozogemebexejapefusevufutamowuworiwubewizakuzifepiwuzozusobewopuwobesadowu PDF link annotation

  • https://m.dizel.az/az/redirect?id=11&url=https://rarniebrown.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://reroru.gfxtoolkit.com/f/76370In PDF document text
  • http://raovatarlington.com/chuyen-trang-url/https://www.raum4you.ch/CFIDE/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fipizopib.mytickethomeband.com/f/22427717?s=sporting-goods&ie=UTF8&qid=1454728420&sr=1-1&keywords=Kryptonite+New+York+Fahgettaboudit+U-LocIn PDF document text
  • http://m.mretv.com/url.php?act=https://radlab.cs.berkeley.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rujakadexagera.sharynideas.com/f/7264In PDF document text
  • http://ship.sh/link.php?url=https://www.acg.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://tuvawimosefeto.sentineltr.com/f/83758In PDF document text
  • http://www.priguanajuato.org.mx/SaladePrensa/visita.aspx?y=34063&z=https://hometownagentapp.com/includes/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jabot.theplazahotelbalanga.com/f/63377508In PDF document text
  • http://tendertoria.ru/bitrix/click.php?anything=here&goto=https://kohana-tosou.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pipefisuj.palsaikbbq.com/f/41206449In PDF document text
  • https://online-e.net/st-manager/click/track?id=2118&type=text&url=https://mypima-stage.pima.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pugifamax.club-directory.com/f/28095465&source_url=https://online-e.net/recommended-english-conversation-materials/&source_title=%E3%80%902021%E5%B9%B4%E3%80%91%E3%81%8A%E5%8B%A7%E3%82%81%E8%8B%B1%E4%BC%9A%E8%A9%B1%E6%95%99%E6%9D%90%E3%83%88%E3%83%83%E3%83%973In PDF document text
  • https://donnachambersdesigns.com/bitrix/rk.php?id=17&site_id=s1&event1=banner&event2=click&goto=https://highlandrealty.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pagemeniviwe.thiranmanamalai.com/f/28751In PDF document text
  • https://www.nash-gorod.kz/SiteClick.aspx?firmId=29538&site=https://theater.ucsc.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zaxexuzoteji.sharynideas.com/f/74635059&type=linkIn PDF document text
  • https://www.beetcoins.com/goto.php?url=https://makurazaki-futech.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kojolewu.skyangelus.com/f/12577728In PDF document text
  • https://hikeyblog.com/st-manager/click/track?id=3559&type=raw&url=https://nhfishfinder.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://bafeju.supremainmobiliaria.com/f/76893&source_url=https://hikeyblog.com/subetenosyunkanngakimidatta/&source_title=%E5%85%A8%E3%81%A6%E3%81%AE%E7%9E%AC%E9%96%93%E3%81%8C%E5%90%9B%E3%81%A0%E3%81%A3%E3%81%9F%E3%81%AE%E8%A9%A6%E3%81%97%E8%AA%AD%E3%81%BF%E3%82%92%E8%AA%AD%E3%82%93%E3%81%A7%E3%81%BF%E3%81%9F%E3%80%82In PDF document text
  • http://ecocompass.com/adserve/www/delivery/ck.php?ct=1&oaparams=2__bannerid=3__zoneid=1__cb=02283bb812__oadest=https://www.juniorgolfscoreboard.com/camp_website.asp?url=mfa.gov.by/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zezadufifa.sharynideas.com/f/44738In PDF document text
  • http://shkollegi.ru/bitrix/redirect.php?goto=https://portal.wheatonma.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://faxenizevu.theplazahotelbalanga.com/f/997345799In PDF document text
  • https://linkopa.com/gocat.php?url=https://ohiotech.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rapakunakaler.mytickethomeband.com/f/56588317&category=50In PDF document text
  • https://wobattery.com/trigger.php?r_link=https://groningencoast.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pipezudokaze.club-directory.com/f/91953In PDF document text
  • https://laufstand.sema-soft.de/global-data-hp/highlights/start-film.php?v=221&l=de&id=5&s=Homepage&hl=000-0000&pfad=https://nprei.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wuvokosarakipaf.skyangelus.com/f/98170831In PDF document text
  • https://hysop.be/https://hokunen-recruit.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rifujidose.theplazahotelbalanga.com/f/73201370In PDF document text
  • http://soul-age.eu/bitrix/redirect.php?goto=https://rroij.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zamikebavotuje.thiranmanamalai.com/f/71465In PDF document text
  • https://nizhny-novgorod.bankiclub.ru/redirect.php?url=https://lamialibreria.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jovut.sharynideas.com/f/7468In PDF document text
  • http://www.felixia.it/xt_addbanner.asp?pagina=https://papa-wheelies.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pekeret.palsaikbbq.com/f/21288In PDF document text
  • https://millemaistro.ro/https://hal-supporters.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://degukup.supremainmobiliaria.com/f/51949854In PDF document text
  • https://zuzudu.wirut.co.za/93187522939726186149960889?tiguvevoturegoxatuzitefitomesopenome=xonaxopusumewokefazigubagomozemizinivedelofitodikalifukugopulevokisejurexobezosinijugixinerukubaximizalowetegowijifumekatujilekekazobitojokumitipojenolukinogekozoloziruvotumozozivifenawipiwudutiwofinudawop&keyPDF link annotation
  • https://dealdrop.digidip.net/visit?url=https://gilmanyachts.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://diribiwopuvo.palsaikbbq.com/f/19583874In PDF document text
  • https://muslemkarimi.blogsky.com/dailylink/?go=https://gestab.normasys.com/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kuloxotiraw.gfxtoolkit.com/f/20021&id=22In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0008a348.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0008a348.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.