PDF / .VIR static analysis report

Heuristics 4

• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dojikubosat.mebel-rastem.com/698081.pdf In PDF document text

  • https://trilogy-of-magnetics-5th-edition-pdf.mctreadiness.com/526907.pdfIn PDF document text
  • https://siriusxm-channel-listing-pdf.ableoaks.com/relef.pdfIn PDF document text
  • https://occupation-based-activity-analysis-2nd-edition-pdf.nhlbi-proteomics.org/990037.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/cd78831f-4eb8-4b4f-9033-7b86a44d0dd3/downloads/kingdom_hearts_union_x_classic_kingdom_guide.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/5d3ed51f-c0b0-4732-aeeb-692b81b2e135/downloads/44902886269.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64edefda556e591a8cca3457/655a922e6ef862d6643272ae_seralaribafozasigi.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/5a2fd4f9-f4de-4c61-b80f-a71d4152a4f2/downloads/risarisa.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/8714fd15-b950-415f-b2e4-5dbe11485cfc/downloads/36822383010.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/cac64821-2205-4248-abd9-55e775312c94/downloads/1957618203.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64f1ab9aa440914b4af0c500/655a91d71f4650d9c5235482_seroja.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/67fef9ac-d473-4758-a664-f936b518bb74/downloads/marketing_consultant_resume.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/5d3ed51f-c0b0-4732-aeeb-692b81b2e135/downloads/aristo_politika_kitap_ozeti.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64eddf87d8d67232b3a1a71e/655a91a14cb61f6f2b62aff4_33970848575.pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0002a813.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0002a813.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.