Malicious PDF / .VIR — malware analysis report

Heuristics 5

• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://ladyvenus.it/userfiles/files/87965613322.pdf In PDF document text

  • https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/8a1dedbaed006349a165a60a0fc4242f/71637090407.pdfIn PDF document text
  • https://kiwapibipup.weebly.com/uploads/1/4/1/8/141865467/zukudipetal_kiraxa_kuxixisud.pdfIn PDF document text
  • http://tageedesign.com/ssmpt/documents/file/fiforuxomusikuguzogi.pdfIn PDF document text
  • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/42ls2on7v73j1em9qumo4sseoi/69856779468.pdfIn PDF document text
  • https://japipelajodog.weebly.com/uploads/1/4/1/6/141677625/fadd6.pdfIn PDF document text
  • https://www.projectorrentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/1629342c3d1b5c---79686592360.pdfIn PDF document text
  • http://shbaicun.com/userfiles/file/2022060601121273499.pdfIn PDF document text
  • http://youil.org/userData/board/file/13286895138.pdfIn PDF document text
  • http://membranekeyboard.pl/_data/file/61160438420.pdfIn PDF document text
  • http://szablon10.jetweb.pl/panel/kcfinder/upload/files/zutogu.pdfIn PDF document text
  • http://glearningsolutions.com/userfiles/files/vuzuzatutuse.pdfIn PDF document text
  • https://marblo.com/app/webroot/img/files/31730982624.pdfIn PDF document text
  • https://sowofodifidem.weebly.com/uploads/1/3/1/8/131856479/kinuf.pdfIn PDF document text
  • https://foodexgida.com/uploads/files/tijorunosufaxavakiru.pdfIn PDF document text
  • http://bushurov.ru/images/files/16472774645.pdfIn PDF document text
  • https://jagotizepevex.weebly.com/uploads/1/3/4/4/134464701/mupatawox.pdfIn PDF document text
  • https://gamepenofaw.weebly.com/uploads/1/4/1/4/141444799/nunubinos.pdfIn PDF document text
  • http://es-umzuege-transporte.de/wp-content/plugins/super-forms/uploads/php/files/c43ebe19fd8aa3f624df1612aad13115/31973897030.pdfIn PDF document text
  • http://foaptoa.com/c3?utm_term=naija+movies+download+sitePDF link annotation
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62d8bafdb589662c83baafde/1658370813843/digutinuranotoneziguji.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b2edda515cb707b8c33bb3/1655893466869/ada_guidelines_2019_espaol.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62deebaf1927f357dcd0d0e9/1658776495594/taskmaster_season_7_episode_guide.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b7baa6cef79d144843eaff/1656208039548/povedolebiz.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62c748415706335255206f76/1657227329943/mulanapumujakap.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62d144d1d443b62b622690c1/1657881810181/in_the_arms_of_an_angel_mp4_download.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c4e821bc14ba37a0f312ad/1657071649311/valuzagunilozus.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62cd8e78f5992412e5393533/1657638521636/tabla_de_conjugacion_de_verbos_en_in.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62ddb5adce84dc1512039d23/1658697134548/lemuwosodopapinadiri.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62e6f6672baf2f38026b24fb/1659303527330/advanced_transportation_engineering_nptel.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62e79f7b35df1d5fc2f2f443/1659346811408/guidewire_claimcenter_configuration.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62cab5ec06905754637957cd/1657452013375/89214269839.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62e2cd0555cd9d77a4bc2e2a/1659030790448/xatudiv.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0003e114.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0003e114.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.