Malicious PDF / .VIR — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
  PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://crochet-cross-pattern-pdf.girlcodeghana.org/860.pdf In PDF document text

  • https://adservice.google.com.sv/ddm/clk/426382440;228185261;d;;%3F//xijexufoto.tuvekiw.sbs/tibimawosalatexofab.pdfIn PDF document text
  • http://adservice.google.co.ke/ddm/clk/426382440;228185261;d;;%3F//womotozub.veekayindia.com/35.pdfIn PDF document text
  • http://gikitib.harleydanswebdesigns.com/5154836.pdfIn PDF document text
  • https://adservice.google.co.ug/ddm/clk/448794861;252804937;a;;%3F//img1.wsimg.com/blobby/go/3af0602e-e6b8-430e-86d1-567d4658c658/downloads/past_tense_vs_present_perfect_exercises.pdfIn PDF document text
  • https://adservice.google.com.bo/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/62505339-f439-4a90-9683-5dbadd0e290d/downloads/jufewulitatuveginumak.pdfIn PDF document text
  • https://adservice.google.com.mm/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/a435afa7-bc93-481f-8a35-ce503cc8a972/downloads/zutibemep.pdfIn PDF document text
  • http://onlinemeded-intern-guide-pdf-free.akykensetsu.site/lobodurobemeku.pdfIn PDF document text
  • https://adservice.google.com.bo/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/a435afa7-bc93-481f-8a35-ce503cc8a972/downloads/jekuveloxali.pdfIn PDF document text
  • http://introduction-to-web-technology-pdf.miondropind.com/9289943.pdfIn PDF document text
  • https://adservice.google.com.ec/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/25f0f271-fa8c-4673-ae0b-6d8816509d0e/downloads/liwalezejubegewikosinin.pdfIn PDF document text
  • https://religious-good-morning-gif.baxarirora.online/bavobixemozebixanap.pdfIn PDF document text
  • https://xukun.haviol.co.za/781277988200250384?zevebulixidufalunusepopibevinuxep=nitofigezowonufirulefusivorubejuximizisubosulolekagazasunivurirokelesaraluvimomixipasiminuwafafejovonuruzulifujibizajixenulojulegoposiparefonifavidunepavolulivewubizejeripelejobumokuzosevimuwewefuribenitox&utm_kwd=neoplatonic+philosophy+introductory+readings+pdf&bajikotasadedovizaxipigerukiwawaxorijawozaruzovavivasamuzekotidiremomiwikipisowezek=bufepamejadolugigelomeralajonotasididejasojotisepadokitekiluxumebatorogidububojanobugiduzijovemobemokidIn PDF document text
  • https://adservice.google.com.ly/ddm/clk/408533097;208818505;l;;%3F//vamazux.xemodemig.sbs/xezaxelupesisekepar.pdfIn PDF document text
  • https://xukun.haviol.co.za/781277988200250384?zevebulixidufalunusepopibevinuxep=nitofigezowonufirulefusivorubejuximizisubosulolekagazasunivurirokelesaraluvimomixipasiminuwafafejovonuruzulifujibizajixenulojulegoposiparefonifavidunepavolulivewubizejeripelejobumokuzosevimuwewefuribenitox&utm_kwd=neoplatonic+philosophy+introductory+readings+pdf&bajikotasadedovizaxipigerukiwawaxorijawozaruzovavivasamuzekotidiremomiwikipisowezek=bufepamejadolugigelomeralajonotasididejasojotisepadokitekiluxumebatorogidPDF link annotation
  • https://adservice.google.me/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/a6e5b43b-79f3-41f8-8a97-1e85ec33928f/downloads/wikipedia_sinhala_download.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/62505339-f439-4a90-9683-5dbadd0e290d/downloads/promark_vr_drone_controller_manual.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/46baf80b-2def-4f9f-867f-a53099c01c32/downloads/kifip.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/9c6cbe7f-76d2-4aee-a849-f537de278d42/downloads/19356365782.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/18193687220.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/ef68f5bf-1c9e-4947-a4bc-478dc938b22c/downloads/glo_internet_settings_for_android_2020.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/62505339-f439-4a90-9683-5dbadd0e290d/downloads/kukarufuzagu.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/3d96c8cf-196a-49d7-b6a7-c181cafe58a0/downloads/phone_caller_location_tracker_app_for_android.pdfIn PDF document text
  • https://adservice.google.kg/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/9978fe41-dbcb-4b88-8a80-a839de3f86b5/downloads/48457561049.pdfIn PDF document text
  • https://adservice.google.mk/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/3af0602e-e6b8-430e-86d1-567d4658c658/downloads/mekutawipawebevabo.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/ef68f5bf-1c9e-4947-a4bc-478dc938b22c/downloads/61700209711.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/4ec11559-69c0-4903-84a6-3240babfcfe7/downloads/zujotekiz.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/a6e5b43b-79f3-41f8-8a97-1e85ec33928f/downloads/korufunizizojejozilovugo.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/9c6cbe7f-76d2-4aee-a849-f537de278d42/downloads/46402349470.pdfIn PDF document text
  • https://adservice.google.gg/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/25f0f271-fa8c-4673-ae0b-6d8816509d0e/downloads/loxukukaletakesokun.pdfIn PDF document text
  • https://adservice.google.co.jp/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/4df17553-d488-446a-b415-1830cd0ff26f/downloads/rudanenuvubosolegaboz.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/12664705030.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/a435afa7-bc93-481f-8a35-ce503cc8a972/downloads/19786226494.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/106d7ab1-a4cc-40be-b51a-774b10def1e7/downloads/85912705138.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/4ec11559-69c0-4903-84a6-3240babfcfe7/downloads/rinamizanunupig.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/ef68f5bf-1c9e-4947-a4bc-478dc938b22c/downloads/video_to_mp3_app_download_apk.pdfIn PDF document text
  • https://adservice.google.com.au/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/a435afa7-bc93-481f-8a35-ce503cc8a972/downloads/subject_and_predicate_worksheets_for_fifth_grade.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/a70789f9-2534-4495-aa9a-53887c8629aa/downloads/pokemon_super_mystery_dungeon_fast_leveling_guide.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/a70789f9-2534-4495-aa9a-53887c8629aa/downloads/bijulaliweta.pdfIn PDF document text
  • https://adservice.google.tg/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/b65b3832-3c1d-4282-95ad-24d47b4834b2/downloads/11234965058.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000aab2b.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000aab2b.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.