Malicious PDF / .VIR — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.beetcoins.com/goto.php?url=https://lawnetportal.law.columbia.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zoxani.sharynideas.com/f/34976898 In PDF document text

  • https://www.vjkglobal.com/home/goto?url=https://uploads-ssl.webflow.com/660025bb87988c9b1274c067/66338d5f4b2bef675d0eee49_dozuzati.pdfIn PDF document text
  • http://onlyindiangirls.pro/redirect/?url=https://rsss.ece.illinois.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://rebube.thiranmanamalai.com/f/41847In PDF document text
  • https://newboard.vetaxa.com/i/?i=https://assets.website-files.com/65f02f0f69146c75a8a59b6a/66338c28f6122b68afe6c996_58037821942.pdfIn PDF document text
  • https://www.ies-diegomarinaguilera.es/es/bannerlink.asp?id=47&web=https://jmars.asu.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://baxovezalajado.gmcalaya.com/f/83680469In PDF document text
  • https://ppid.untan.ac.id/download/?id_jenis=1&id=570&url=https://uploads-ssl.webflow.com/65dcbc1f6cf993530c9e1576/66338c6104e2923f4c37bdec_52280556881.pdfIn PDF document text
  • https://devilmountainnursery.xecurify.com/moas/broker/login/jwt/logout/274346?client_id=n92u6orbf31lj9ma4u1hj24k8geyewm&redirect_uri=https://lanegarrett.net/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://vububisopos.salvaralbucardo.com/f/53993In PDF document text
  • https://www.elmarket.by/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://ozcemtonerkartus.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jasebofijomepos.sharynideas.com/f/20895In PDF document text
  • http://go.fanhuan.com/redirect/?tuan=y&site=sixiju.com&p=https://hillel.princeton.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://nexiner.ibcphoenix.com/f/45628543In PDF document text
  • https://mobials.com/tracker/r?type=click&resource_id=4&business_id=860&ref=https://myportal.cccs.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://zatupejo.mytickethomeband.com/f/10696287In PDF document text
  • http://xn--80adypkng.xn--p1ai/bitrix/redirect.php?goto=https://lakelandcc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://laxivelegadipe.ibcphoenix.com/f/26465664In PDF document text
  • http://forum.cars33.ru/go.php?link=https://grail.stanford.edu/sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gojekufafirix.palsaikbbq.com/f/127404217In PDF document text
  • http://www.inetbet.com/affiliates/aiddownload.asp?affid=1579&redirect=https://iamgmembers.org/wysiwyg/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fosodew.ibcphoenix.com/f/56821722In PDF document text
  • https://dekruijftrappen.nl/https://msmconnect.msm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pisejos.sentineltr.com/f/796058507/In PDF document text
  • https://www.jamonprive.com/idevaffiliate/idevaffiliate.php?id=102&url=https://hypnosisresearchinstitute.org/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jofesepit.salvaralbucardo.com/f/23978In PDF document text
  • http://pornharvest.com/sp.php?i=&t=screencap&u=https://online.uas.alaska.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://sufiretiroruwa.thiranmanamalai.com/f/39311275In PDF document text
  • https://thereport.be/article/?u=https://www.steu.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gojorud.supremainmobiliaria.com/f/77229513&n=0&s=2&c=1&pn=AnonymousIn PDF document text
  • http://chandi.com.ua/go.php5?url=https://uploads-ssl.webflow.com/65dcd0a17cf3fcb6474d4c0c/66338ca1c533f59e93c20029_17465377525.pdfIn PDF document text
  • https://spoq.demo.registercentrum.se/download?fileUrl=https://assets.website-files.com/6600157085fd1ac39a32574c/66338dc4c533f59e93c312c5_sakemisawez.pdfIn PDF document text
  • https://www.sleviste.cz/exit?offer_id=3692032130&product_id=740037023&target_url=https://rsss.ece.illinois.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wudarora.thiranmanamalai.com/f/41671In PDF document text
  • http://owl.ru/links.php?go=https://msmconnect.msm.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://luraladibojujus.gfxtoolkit.com/f/2927In PDF document text
  • https://apuntomichelcoya.com/out/?bid=53&url=https://arch.rice.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kisebu.thiranmanamalai.com/f/4070In PDF document text
  • https://ansaligy.com/bitrix/redirect.php?goto=https://uploads-ssl.webflow.com/660032d3ebd7404f85483604/66338c4218f2df13d95fb051_79793847211.pdfIn PDF document text
  • https://nnrblog.com/st-manager/click/track?id=3921&type=raw&url=https://my.nwacc.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://legetaje.sentineltr.com/f/7175In PDF document text
  • http://svmeas.rion.co.jp/topics2.aspx?category=0&managecode=996029&mode=2&title=%E9%9F%B3%E9%9F%BF%E6%A0%A1%E6%AD%A3%E5%99%A8%20NC-75%20%E3%81%AE%E5%8B%95%E7%94%BB%E3%82%92%E5%85%AC%E9%96%8B%E3%81%97%E3%81%BE%E3%81%97%E3%81%9F&url=https://www.mondragon.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pofuvepogavu.gfxtoolkit.com/f/20786In PDF document text
  • https://forex-arabic.com/redirect.php?url=https://koujinkai-recruit.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fisaruwuxat.thiranmanamalai.com/f/85113688In PDF document text
  • http://usaxtube.com/cgi-bin/uxt.cgi?url=https://campus.murraystate.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://givakef.thiranmanamalai.com/f/60882In PDF document text
  • https://bon-app.ch/redirect.php?action=url&goto=https://info.accs.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lapusisuwekawed.thiranmanamalai.com/f/63092443In PDF document text
  • http://kcm.kr/jump.php?url=https://assets.website-files.com/66000fe2ba0f8534535a5ba3/66338c3cca863569d821cfed_322566168.pdfIn PDF document text
  • https://www.elquartiere.com/redirectBanner.asp?url=https://assets.website-files.com/65dccd31004d414215671ac7/66338c0a7fe75fb2277c468d_zapamuxotigarodoxota.pdf&image=bannercartechinisnc.gifIn PDF document text
  • https://ditan.tevav.co.za/73779311368477606711591275?pokabasepoxilawiwevaz=sifiwobeladowufexegivajoxikuwamijavulusuduzitagezexumosekawisunegoburadelelonuxevikoxatijabowunazoribitukufusaliguvizidefibujotixuxaroxeparumebedipekudivugenovinuxulokepuguvagitukusasajajefodobusiwowijegikit&keyword=step+3+worksheets+alcoholics+anonymous&rafudoxugixizititiduzafifeniwagokevabawixivexemawapolegin=kagoxujurojirofoxixofidakusoluxaliwuribixaxipofenosabizenabikapovaperifufadopolevisijeretafumilemuwalenixetopagedubizajupomavixirasateIn PDF document text
  • http://news.troma.cz/newsletter/newsletter-redirect?url=https://activity.scar.gmu.edu/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pelirizemubid.salvaralbucardo.com/f/76502259In PDF document text
  • https://ditan.tevav.co.za/73779311368477606711591275?pokabasepoxilawiwevaz=sifiwobeladowufexegivajoxikuwamijavulusuduzitagezexumosekawisunegoburadelelonuxevikoxatijabowunazoribitukufusaliguvizidefibujotixuxaroxeparumebedipekudivugenovinuxulokepuguvagitukusasajajefodobusiwowijegikit&keyword=step+3+worksheets+alcoholics+anonymous&rafudoxugixizititiduzafifeniwagokevabawixivexemawapolegin=kagoxujurojirofoxixofidakusoluxaliwuribixaxipofenosabizenabikapovaperifufadopolevisijeretafumilemuwalenixetopagePDF link annotation
  • https://ditan.tevav.co.za/73779311368477606711591275?pokabasepoxilawiwevaz=sifiwobeladowufexegivajoxikuwamijavulusuduzitagezexumosekawisunegoburadelelonuxevikoxatijabowunazoribitukufusaliguvizidefibujotixuxaroxeparumebedipekudivugenovinuxulokepuguvagitukusasajajefodobusiwowijegikit&keyword=step+3+woPDF link annotation
  • https://epd.expasy.org/epd/external_resources.php?address=https://faqs.sinclair.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pisudogifozex.supremainmobiliaria.com/f/39815476In PDF document text
  • https://login.uleth.ca/cas/login?gateway=true&service=https://assets.website-files.com/65ffcdd9ceef86766548f0c6/66338d6e3cea857c64e81c64_webifedu.pdfIn PDF document text
  • https://pdcnet.org/collection-anonymous/addBookmark.do?docid=chora_2016_0014_0307_0310&url=https://assets.website-files.com/6600523fe2ebce24aa376a5f/66338d0ea4f632473c19c6a8_79866180621.pdfIn PDF document text
  • https://iranianpigeonsincanada.blogsky.com/dailylink/?go=https://assets.website-files.com/66004a40ced8da2d60581d3a/66338cdf1dde3bc2cfe11c37_judux.pdf&id=1In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000b331a.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000b331a.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.