Malicious PDF / .VIR — malware analysis report

Heuristics 9

• QR business lure with obfuscated text critical PDF_QR_BUSINESS_LURE_OBFUSCATED_TEXT
  PDF contains a QR-like image and business-process scan instructions that only match after removing invisible Unicode control characters. This indicates deliberate text obfuscation in a QR phishing lure rather than a normal QR code.
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
  PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
• Unusually high stream count medium PDF_MANY_STREAMS
  PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
• Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
  PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
• ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
  ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
• PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
  The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://132.248.181.216/acl/EnDesarrollo.html PDF link annotation

  • https://meltdownattack.com/In PDF document text
  • https://liquorix.net/In PDF document text
  • https://xanmod.orgIn PDF document text
  • http://132.248.181.216/Herramientas/In PDF document text
  • https://privacytests.orgIn PDF document text
  • http://www.drjava.org/In PDF document text
  • https://www.jgrasp.org/In PDF document text
  • https://www.bluej.org/In PDF document text
  • http://www.jcreator.com/index.htmIn PDF document text
  • https://codenvy.com/In PDF document text
  • http://www.pydev.org/In PDF document text
  • https://wingware.com/In PDF document text
  • https://www.uml.org/In PDF document text
  • http://www.kdbg.org/In PDF document text
  • http://www.iexplain.org/using-git-with-google-drive-a-tutorial/In PDF document text
  • https://github.com/In PDF document text
  • https://github.com/antoniocarrillo69/ejemploPruebas.gitIn PDF document text
  • https://www.jdoodle.com/In PDF document text
  • http://browxy.comIn PDF document text
  • https://tio.run/In PDF document text
  • https://www.compilejava.net/In PDF document text
  • http://codepad.org/In PDF document text
  • https://www.remoteinterview.io/online-c-compilerIn PDF document text
  • https://hackide.herokuapp.com/In PDF document text
  • https://codebunk.com/In PDF document text
  • https://rextester.com/In PDF document text
  • https://www.compileonline.comIn PDF document text
  • http://python...ddle.com/In PDF document text
  • https://www.rollapp.com/In PDF document text
  • https://www.codiva.io/In PDF document text
  • https://paiza.io/enIn PDF document text
  • https://wandbox.org/In PDF document text
  • http://coliru.stacked-crooked.com/In PDF document text
  • http://quick-bench.com/In PDF document text
  • https://cppinsights.io/In PDF document text
  • http://collabedit.comIn PDF document text
  • https://gitduck.com/In PDF document text
  • https://codeshare.io/In PDF document text
  • https://codebunk.comIn PDF document text
  • https://coderpad.io/In PDF document text
  • https://peerpad.net/In PDF document text
  • https://codeanywhere.com/In PDF document text
  • https://stekpad.com/home/In PDF document text
  • http://cpp.sh/In PDF document text
  • http://pythonfiddle.com/In PDF document text
  • https://www.linuxfundation.orgIn PDF document text
  • http://www.fsfla.org/ikiwiki/selibre/linux-libre/In PDF document text
  • https://openssf.orgIn PDF document text
  • https://azure.microsoftIn PDF document text

  +167 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.