PDF / .VIR static analysis report

Heuristics 4

• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://uploads-ssl.webflow.com/64ede6685c5bb10d1a335af5/65359568c3ba19b43f15e7e3_vobazolotusirom.pdf In PDF document text

  • https://uploads-ssl.webflow.com/64edfdff2ac18b274452201b/65359226093a084eeb366367_bikuposobujezos.pdfIn PDF document text
  • https://irp.cdn-website.com/1cb9a07d/files/uploaded/soxavozanogise.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64f853507f219e64ae3956af/65359495dab6affbb1645434_nunagubumonevegub.pdfIn PDF document text
  • https://irp.cdn-website.com/a989f86d/files/uploaded/58043560.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64f83ba8b20067338172a01c/653592fd17daafaf2943ff3e_8951701412.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/950cc514-ff7f-4c46-9852-0d0546af881f/downloads/34436956808.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/2cb9eae2-7541-4f2e-a964-d78943f56331/downloads/13602736012.pdfIn PDF document text
  • https://irp-cdn.multiscreensite.com/77f6d0f1/files/uploaded/nufirajidomorizatikefez.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/fc4fc1f1-bd6e-431d-9ea6-a9480fbfbe2c/downloads/zamagapokobigabi.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/4c16c9c3-6074-4f92-9f7a-6f83dc8f7e16/downloads/pefatemiweripulajemawuwam.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64edf517105dd3360241f058/65359227d827f09432ff15a0_57948530458.pdfIn PDF document text
  • https://uploads-ssl.webflow.com/64ee1405013f436ded58455a/6535934217daafaf29442e54_bemurasejudatasopitanebol.pdfPDF link annotation
  • https://uploads-ssl.webflow.com/64edd6777c2a913505e144a9/653592023ca73a37605c03bc_dukurev.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/46aa347d-befa-4bdf-9575-549fd313b074/downloads/bidujipazezulojur.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00068840.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00068840.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.