Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=urban-river.pdf

  • http://uncpbisdegree.com/download4.php?q=urban-river.pdf
  • http://www.windrivertinyhomes.com/urban-micro-home
  • http://urbanriv.org/
  • https://www.centerfortheurbanriver.org/about/
  • https://urbankayaks.com/
  • http://rivercitytoronto.com/
  • http://www.urbankneads.com/
  • http://www.libelium.com/smart-city-urban-resilience-smart-environment/
  • http://www.clydewaterfront.com/
  • http://www.urbanbeanco.com/
  • http://urbanflyfisher.com/
  • http://www.whiterivercu.com/
  • http://www.sanantonioriver.org/museum_reach/museum_reach.php
  • http://www.whitewaterexpress.com/chattahoochee/
  • http://www.thebohemianblog.com/2013/07/urban-exploration-lost-river-effra-uk.html
  • http://ctriveracademy.org/
  • http://www.coolgeography.co.uk/gcsen/urban_issues.php
  • https://trca.ca/conservation/
  • http://www.panepintoproperties.com/
  • http://demographia.com/
  • http://www.forbidden-places.net/
  • http://uncpbisdegree.com/1/the-elder-scrolls-v-skyrim-official-prima-guide-bd.pdf
  • http://uncpbisdegree.com/1/spinoza-and-the-irrelevance-of-biblical-authority.pdf
  • http://uncpbisdegree.com/1/sewing-for-dummies-janice-saunders-maresh.pdf
  • http://uncpbisdegree.com/1/the-gangs-of-new-york-an-informal-history-of-the-underworld.pdf
  • http://uncpbisdegree.com/1/the-german-chemical-industry-in-the-twentieth-century-1st-edition.pdf
  • http://uncpbisdegree.com/1/telecharger-saules-aveugles-femme-endormie.pdf
  • http://uncpbisdegree.com/1/spelling-morphology-the-psycholinguistics-of-hebrew-spelling.pdf
  • http://uncpbisdegree.com/1/sony-cybershot-dsc-t300-manual.pdf
  • http://uncpbisdegree.com/1/the-film-greats.pdf
  • http://riverside-resort.net/1/world-enough-time.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://www.umb.edu/uhi
  • https://en.wikipedia.org/wiki/Urban_area
  • http://www.startribune.com/st-anthony-falls-birthplace-of-a-city-could-deliver-new-visions-of-an-urban-river/428052293/
  • https://www.epa.gov/urbanwaterspartners
  • https://en.wikipedia.org/wiki/North_Saskatchewan_River_valley_parks_system
  • http://www.sanjoseca.gov/index.aspx?NID=2892
  • http://www.sanjoseca.gov/index.aspx?NID=3053
  • http://www.sanjoseca.gov/index.aspx?NID=585
  • http://www.businessinsider.com/dallas-trinity-river-park-project-2016-12
  • http://www.startribune.com/what-pollutes-the-urban-mississipp-lawns-dogs-and-lots-of-pavement/417995413/
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
  • https://go.microsoft.com/fwlink/?linkid=868922
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
  • http://go.microsoft.com/fwlink/?LinkID=617297
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Open this report in the interactive analyzer, or submit your own file for analysis.