Malicious PDF / .VIR — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.ktamoto.ru/links.php?go=https://iconnect.mwcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://garojeme.palsaikbbq.com/f/23211410 In PDF document text

  • http://gundemekonometre.com/advertising.php?r=5&l=https://pacificapet.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://netoji.manabi-subete.com/f/85170104&gclsrc=aw.dsIn PDF document text
  • http://drawschool.ru/go/url=https://assets.website-files.com/65efffe8d4e10d26910f0543/6633a9c12ea9f45714d94bfa_wafugonurefiremexeviwob.pdfIn PDF document text
  • https://milftube.su/xxx.php?link=video&p=100&u=https://mai-avto.ru/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kadojoj.skyangelus.com/f/70057In PDF document text
  • http://www.amtchina.org/redirect.asp?MemberID=F154&Url=https://kobayashi-onlineshop.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://begopefox.theplazahotelbalanga.com/f/7031705In PDF document text
  • https://zhit-vmeste.ru/bitrix/rk.php?goto=https://assets.website-files.com/65f03c1adf9d6d64858c8deb/6633aa017a30e2733c921bff_sinofezekafimojuba.pdf&url=http://ec.dualjuridik.org/6323-how-is-the-energy-systems-language-used-in-ecology.htmlIn PDF document text
  • http://www.circlepix.com/link.htm?_url_=https://uploads-ssl.webflow.com/65f03141d051760b06967328/6633a9de2ea9f45714d96df8_worabov.pdf&_elid_=1872963&_linkname_=https://uploads-ssl.webflow.com/65f03141d051760b06967328/6633a9de2ea9f45714d96df8_worabov.pdfIn PDF document text
  • http://www.konczewice.pl/?wptouch_switch=desktop&redirect=https://uploads-ssl.webflow.com/65dcd46fa0671b2619a77742/6633a9d573de85f78957ee71_13466994789.pdfIn PDF document text
  • https://hajozas.hu/webkamera/tihany-hajoallomas/?action=redirect&url=https://historyhappyhour.com/common/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://nadavixunazafub.salvaralbucardo.com/f/38640&id=39639In PDF document text
  • https://need4toys.eu/https://myuagm.uagm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zabigozagise.supremainmobiliaria.com/f/81142533In PDF document text
  • http://www.midtownmonthly.net/2157/?administer_redirect_26=https://www.colin.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wuvom.sentineltr.com/f/9142In PDF document text
  • http://circutor.ru/bitrix/rk.php?goto=https://ninjarpg.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://makamexetukigaz.palsaikbbq.com/f/33374In PDF document text
  • https://teko.biz/bitrix/redirect.php?goto=https://uploads-ssl.webflow.com/65dcd23d9aed7f8fc57be2c1/6633aa229c941772921918ca_zenigel.pdfIn PDF document text
  • http://www.englishforliving.com/banclickredir.jsp?link=https://uploads-ssl.webflow.com/65f024be4457f98926567084/6633a9fddf1d4bd8c03e1c29_jewuk.pdf&id=119&t=1700931447408In PDF document text
  • https://revolving.ru/r.php?event1=mainnews&event2=upvideo&goto=https://pantelleria.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://bavexut.sharynideas.com/f/77871In PDF document text
  • http://www.vcsp.info/books.aspx?name=https://novussiteyonetimi.com/FCKeditor/editor/filemanager/browser/default/browser.html?Connector=https://saxosa.supremainmobiliaria.com/f/41576In PDF document text
  • https://chara-deco.com/blog/out_count.html?url=https://relocatingtosf.org/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sojikorej.skyangelus.com/f/89936750In PDF document text
  • https://bluffler.com/goto/https://odawarakiki.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://donubojezuk.mytickethomeband.com/f/77179961In PDF document text
  • https://www.petstore.kz/bitrix/redirect.php?goto=https://jwccms.jxau.edu.cn/Content/ext/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://nugixafiran.salvaralbucardo.com/f/60831794In PDF document text
  • https://auth.she.com/logout/?client_id=8&callback=https://ilfishfinder.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zejupos.supremainmobiliaria.com/f/30760In PDF document text
  • https://unibocconishop.it/https://nada70.org/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sarudakivin.gfxtoolkit.com/f/4895541In PDF document text
  • https://www.google.com.ng/travel/clk?pc=AA80OsytrUjKGkncOqM7heZ3VMeebLw67XJRqbUVPykMBbo9dyTYDMXJskNKGpf1ZhJYKoAi4N8ePSAUEIzCjsj4f82BzRJ3YUNxVChbdX_81celum1gvX4cu7R3&pcurl=https://rafaela-motores.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pigiwodukunul.skyangelus.com/f/8432503In PDF document text
  • http://webmasterplein.net/referenties.php?click=https://korelirenault.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xukitiwomix.club-directory.com/f/771982829In PDF document text
  • https://kpop-oyaji.com/st-manager/click/track?id=1103&type=raw&url=https://greenfield-sanders.com/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lugeju.salvaralbucardo.com/f/894473086In PDF document text
  • https://kubannews24.ru/goto/https://theater.ucsc.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wumabejim.ibcphoenix.com/f/807477423In PDF document text
  • http://www.bngjzx.com/blog/link.php?url=https://rbcycles.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://timajewetug.salvaralbucardo.com/f/38897In PDF document text
  • https://wevon.gluvoob.com/85648126032757978402054901?ravoluwitafidemapojonadidawijiro=kutisanigetenasupubakupuzipuxadoxipojinugesalijusazedabirofemexabuwizujejojevovivelekeninenenamunamexebinowigokotugofukowejurejupedemegodizopexijuniritinubodavuriwajawapelekunujajibarodutetagiremasonodovuj&keyword=multiplying+6+worksheet&fozesarutijavivedelumafizomanemitafumolelurapodonevalolititot=mazufikodiwajaxozaxibexibasomizezejonufewibimirikokodamovobebepuzitativijutajefevagugamikivitovawonolebukonuduferofutukupegukuteIn PDF document text
  • http://www.nextpicturez.com/xxx/?ID=56429&URL=https://lindapaisley.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wowesowis.gfxtoolkit.com/f/7091In PDF document text
  • https://t.gistmail1.com/c/stzwuYd997NcnIqnwzt3mhLoeRqYdf9w/click?url=https://nutritiousnuts.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jerewivulod.manabi-subete.com/f/63336In PDF document text
  • https://wevon.gluvoob.com/85648126032757978402054901?ravoluwitafidemapojonadidawijiro=kutisanigetenasupubakupuzipuxadoxipojinugesalijusazedabirofemexabuwizujejojevovivelekeninenenamunamexebinowigokotugofukowejurejupedemegodizopexijuniritinubodavuriwajawapelekunujajibarodutetagiremasonodovuj&keyword=multiplying+6+worksheet&fozesarutijavivedelumafizomanemitafumolelurapodonevalolititot=mazufikodiwajaxozaxibexibasomizezejonufewibimirikokodamovobebepuzitativijutajefevagugamikivitovawonolebukonuduferoPDF link annotation
  • https://wevon.gluvoob.com/85648126032757978402054901?ravoluwitafidemapojonadidawijiro=kutisanigetenasupubakupuzipuxadoxipojinugesalijusazedabirofemexabuwizujejojevovivelekeninenenamunamexebinowigokotugofukowejurejupedemegodizopexijuniritinubodavuriwajawapelekunujajibarodutetagiremasonodovuj&keyword=PDF link annotation
  • https://amanaimages.com/lsgate/?lstid=pM6b0jdQgVM-Y9ibFgTe6Zv1N0oD2nYuMA&lsurl=https://my.canisius.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://waraloju.supremainmobiliaria.com/f/58046In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00081763.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00081763.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.