Malicious PDF / .VIR — malware analysis report

Heuristics 5

• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://rejem.sevuner.cfd/nomuxiwasu.pdf In PDF document text

  • https://adservice.google.com.gi/ddm/clk/448794861;252804937;a;;%3F//scheda-per-la-scelta-della-destinazione.zugixejire.sbs/4.pdfIn PDF document text
  • https://social-ethics-morality-and-social-policy.jijekeve.cfd/66.pdfIn PDF document text
  • https://choices-a-basic-guide-to-writing-6th-edi.gabinito.cfd/88.pdfIn PDF document text
  • https://sinibus.raregamestore.com/5192794.pdfIn PDF document text
  • https://adservice.google.co.tz/ddm/clk/408405163;208572896;n;;%3F//a-history-of-world-societies-9th-edition.ocetoneri.com/703.pdfIn PDF document text
  • https://marco-polo-livres.jukepoj.cfd/wonavewadiredikef.pdfIn PDF document text
  • https://tifidot.kugusuz.sbs/6457531.pdfIn PDF document text
  • https://arduino-starter-kit-guide-pdf.tulinabam.cfd/63.pdfIn PDF document text
  • https://delivering-healthcare-in-america-7th-edi.dojaxoro.cfd/jobenupulogu.pdfIn PDF document text
  • https://cost-engineers-notebook-2nd-edition-pdf.mipupubulu.online/juwibexikuro.pdfIn PDF document text
  • https://riwuzivowo.fijavokug.cfd/844130944.pdfIn PDF document text
  • https://2009-hyundai-tucson-repair-manual-pdf.bipumedav.cfd/ganoruvodixisop.pdfIn PDF document text
  • https://zawunugo.workforceok.org/nemizebuzik.pdfIn PDF document text
  • https://free-printable-bible-coloring-pages-pdf.evileyecharm.com/liz.pdfIn PDF document text
  • https://aqa-a-level-chemistry-revision-guide.vejajemov.cfd/bodu.pdfIn PDF document text
  • https://1611-s-airport-way.fezazowed.sbs/zafo.pdfIn PDF document text
  • https://adservice.google.com.ly/ddm/clk/408533097;208818505;l;;%3F//pivuf.zigepas.cfd/sodufuni.pdfIn PDF document text
  • https://giwufugilupe.vajazavij.online/7351871.pdfIn PDF document text
  • https://netgear-gs108-manual.mipupubulu.online/5457944.pdfIn PDF document text
  • https://pemolasezog.canyoncreate.com/59.pdfIn PDF document text
  • https://gas-prices-at-speedway-near-me.mokopavo.sbs/gupezaro.pdfIn PDF document text
  • https://adservice.google.la/ddm/clk/448794861;252804937;a;;%3F//nibazo.guzakaf.cfd/sebetelukalem.pdfIn PDF document text
  • https://adservice.google.dm/ddm/clk/424929466;226923624;r;;%3F//lakeziboro.nunofop.cfd/7967724.pdfIn PDF document text
  • https://adservice.google.ba/ddm/clk/448794861;252804937;a;;%3F//t-l-chargement-audio-youtube.waxapusap.cfd/nedal.pdfIn PDF document text
  • https://adservice.google.ga/ddm/clk/448794861;252804937;a;;%3F//d-d-5e-sword-coast-adventurer-s-guide-pd.wetamubusi.cfd/nafexokolurawiz.pdfIn PDF document text
  • https://adservice.google.lk/ddm/clk/408405163;208572896;n;;%3F//jailyn-ojeda-onlyfans-leak.diwiteboda.sbs/kuriva.pdfIn PDF document text
  • https://adservice.google.ga/ddm/clk/300948314;127869103;e;;%3F//the-merchant-of-venice-act-1-study-guide.fipixasu.cfd/26.pdfIn PDF document text
  • https://adservice.google.ws/ddm/clk/466651624;272226156;i;;%3F//lemon-tree-dental-flushing.thelfb-forex.com/29.pdfIn PDF document text
  • https://adservice.google.sr/ddm/clk/478229754;284365575;c;;%3F//seo-step-by-step-guide-pdf.fadamade.cfd/5053538.pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007e7d1.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007e7d1.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.