Malicious PDF / .VIR — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
  PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kudaselomaju.pizidujel.cfd/wese.pdf In PDF document text

  • https://lapagenogabu.tifikixi.cfd/5087456.pdfIn PDF document text
  • https://adservice.google.co.bw/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/0d80b448-6269-431f-8292-b48d744ee0b9/downloads/piwubaxukaxapikebakarenas.pdfIn PDF document text
  • https://adservice.google.co.in/ddm/clk/425484003;227454619;f;;%3F//tipos-de-electrovalvulas-pdf.xuxoxilosi.cfd/letosatixot.pdfIn PDF document text
  • https://walevolovufu.vuwawuzuw.cfd/xovituzivoxura.pdfIn PDF document text
  • https://world-geography-final-study-guide-answer.ditudixisi.cfd/gomubifuvasopolaxeg.pdfIn PDF document text
  • http://pofusi.debatechamp.com/450166.pdfIn PDF document text
  • http://gavagi.ketanash.org/vevowumosa.pdfIn PDF document text
  • https://adservice.google.com.af/ddm/clk/300948314;127869103;e;;%3F//img1.wsimg.com/blobby/go/b950cb35-4ba6-4e71-9002-a719a6880f3d/downloads/hiv_aids_treatment_guidelines.pdfIn PDF document text
  • https://film-art-an-introduction-10th-edition-pd.kizopemug.cfd/330213.pdfIn PDF document text
  • https://adservice.google.com.np/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/5452ecdb-dfbb-4da2-9d8c-3fae6634db74/downloads/denuzo.pdfIn PDF document text
  • http://nail-test-questions-and-answers.habadaboo.com/visepukajimukipeduf.pdfIn PDF document text
  • https://marketing-grewal-7th-edition-pdf.bisojakaz.cfd/738.pdfIn PDF document text
  • http://human-resource-management-11th-edition-p.gigowl.tech/muxum.pdfIn PDF document text
  • http://xerefopejexi.lawyersandlawfirms.com/domenew.pdfIn PDF document text
  • https://adservice.google.com.vc/ddm/clk/478229754;284365575;c;;%3F//silent-weapons-for-quiet-wars-cody-goodf.vipujexov.cfd/xowuwezamujitigu.pdfIn PDF document text
  • https://kilepi.xenina.co.za/236132244773655672?febomadutatenefadebewujewupagogeke=jekovazasofofenaporagufiwaliwopivelufujevaxiwuvobonorujonanaloxomuvasedexifurowozizitinavefufutiwuxubezamokasipidemubaluwabodasuzurabifopitapanexokajizimexoxilimimurenofudimoxubenifemimamoritenejemodutupober&keyword=5th+grade+math+worksheets+with+answer+key&xitalunenasigupewowazuwijoluneposepexedafabawuveboroluk=veropibilizoxitaverogiberonalekimixolojaxotepejefokajapurodutoximokuxuzaxotovuzelojazufipivovunexonezikesuwemiwitosefuzIn PDF document text
  • https://adservice.google.com.na/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/18e34b03-3b03-4fb7-beb8-59fd831a7367/downloads/usda_guaranteed_loan_program_underwriting_guidelines.pdfIn PDF document text
  • https://kilepi.xenina.co.za/236132244773655672?febomadutatenefadebewujewupagogeke=jekovazasofofenaporagufiwaliwopivelufujevaxiwuvobonorujonanaloxomuvasedexifurowozizitinavefufutiwuxubezamokasipidemubaluwabodasuzurabifopitapanexokajizimexoxilimimurenofudimoxubenifemimamoritenejemodutupober&keyword=5th+grade+math+worksheets+with+answer+key&xitalunenasigupewowazuwijoluneposepexedafabawuveboroluk=veropibilizoxitaverogiberonalekimixolojaxotepejefokajapurodutoximokuxuzaxotovuzelojazufipivovunexonezikePDF link annotation
  • https://kilepi.xenina.co.za/236132244773655672?febomadutatenefadebewujewupagogeke=jekovazasofofenaporagufiwaliwopivelufujevaxiwuvobonorujonanaloxomuvasedexifurowozizitinavefufutiwuxubezamokasipidemubaluwabodasuzurabifopitapanexokajizimexoxilimimurenofudimoxubenifemimamoritenejemodutupober&keyword=5tPDF link annotation
  • https://adservice.google.dz/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/8b53c878-eb53-45d2-8e36-6a9cda74e04e/downloads/worozerog.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/eedb1440-f1d0-435d-bdc7-144eb8f7bdb9/downloads/nupasuxilip.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/8757985c-d3aa-400d-9601-2cab764f1e2f/downloads/ffxiv_bard_guide_2020.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/cc05f418-3134-4be7-bfc9-6e8f673290cc/downloads/56485861548.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/89cf4eb1-1632-42f3-872e-3d44b399d6d9/downloads/telunubilinarofukozinom.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/225b64c8-a1a7-40ef-9ec9-d188316f5873/downloads/frp_bypass_apk_samsung_j1_ace.pdfIn PDF document text
  • http://adservice.google.pt/ddm/clk/478229754;284365575;c;;%3F//2018-honda-civic-owners-manual.imnoslave.org/lelobarafavajoz.pdfIn PDF document text
  • http://adservice.google.at/ddm/clk/425484003;227454619;f;;%3F//book-of-matthew-bible-study-pdf.illectronicnyc.com/texasemegivepodepiz.pdfIn PDF document text
  • http://adservice.google.cm/ddm/clk/300948314;127869103;e;;%3F//olympus-tg-6-manual.mealsonwheelsnortheastoh.net/nas.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/eedb1440-f1d0-435d-bdc7-144eb8f7bdb9/downloads/putuveropiruwom.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/4088f03a-4fe1-448a-9da2-2e698f89cc9f/downloads/tixavalagitalagoviruf.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/3f34b0f6-bfa1-4769-8c7a-d74163e00668/downloads/53006977416.pdfIn PDF document text
  • https://adservice.google.co.uk/ddm/clk/445204615;249060672;c;;%3F//down-to-earth-steinberg-3rd-edition-pdf.man-trs.de/55.pdfIn PDF document text
  • https://img1.wsimg.com/blobby/go/17a3793b-544d-41f2-8755-c520642d4d2a/downloads/pinusurimugururi.pdfIn PDF document text
  • https://adservice.google.ee/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/4088f03a-4fe1-448a-9da2-2e698f89cc9f/downloads/6916792949.pdfIn PDF document text
  • https://adservice.google.dj/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/06026e78-cae1-47d3-92ff-5a1719d04513/downloads/wepiruxifomulufaxamomurox.pdfIn PDF document text
  • https://adservice.google.by/ddm/clk/408533097;208818505;l;;%3F//pot-de-fleur-minecraft.jetojuxiv.cfd/sare.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007e81f.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007e81f.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.