MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged by a machine learning classifier and a specific heuristic for being a fake 'free download' SEO-poisoning document. It contains links to `uncpbisdegree.com` which are presented as download links for a car manual, but are likely gateways to malicious payloads. The document body contains obfuscated text and URLs, further indicating a malicious intent to deceive the user into downloading a file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9340
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=vw-polo-94-99-manual.pdf
- http://uncpbisdegree.com/download4.php?q=vw-polo-94-99-manual.pdf
- http://www.automart.co.za/cars/vw-polo-vivo/gauteng/
- http://www.rossvw.com/vw/
- http://www.oldclassiccar.co.uk/modernads_make/vw.htm
- http://www.rossvw.com/harlequin/
- http://greencarsite.co.uk/low-emissions-cars/
- http://vaglinks.com/
- https://www.wheels24.co.za/NewModels/Volkswagen_Polo/volkswagen-launches-all-new-2018-polo-in-sa-prices-details-and-more-20180124
- http://www.autopartexport.com/Brake
- http://www.freedomcontracts.com/
- http://www.birgersbilligebilboeger.dk/haynes-vaerkstedsboger-og-lign/biler/
- http://uncpbisdegree.com/1/suzuki-baleno-cluster-wiring.pdf
- http://uncpbisdegree.com/1/teac-r-2-user-guide.pdf
- http://riverside-resort.net/1/xtremepapers-past-papers-business-studies.pdf
- http://riverside-resort.net/1/wedding-card-template-free-vintage.pdf
- http://uncpbisdegree.com/1/staar-master-reading-answer-key.pdf
- http://uncpbisdegree.com/1/st-james-encyclopedia-of-popular-culture-5-volume-set.pdf
- http://riverside-resort.net/1/us-history-guided-activity-8-3-answers.pdf
- http://riverside-resort.net/1/vocabulary-review-the-periodic-table-answers.pdf
- http://riverside-resort.net/1/universal-farmliner-530-dtc-workshop-manual.pdf
- http://uncpbisdegree.com/1/ssc-higher-secondary-level-exam-2018-answer-key.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://en.wikipedia.org/wiki/Volkswagen_Polo
- https://en.wikipedia.org/wiki/Volkswagen
- https://www.gumtree.co.za/s-cars-bakkies/volkswagen+vw+polo+vivo+demo/v1c9077q0p1
- https://www.gumtree.co.za/s-automotive-vehicles/volkswagen+vw+polo+vivo+demo/v1c5q0p1
- https://www.aliexpress.com/store/group/For-VW/1797079_501253029/4.html
- https://www.autoevolution.com/cars/volkswagen-polo-5-doors-2005.html
- https://www.manualslib.com/manual/1158893/Dometic-Tec29.html
- https://www.manualslib.com/brand/
- https://www.manualslib.com/brand/dometic/
- https://www.manualslib.com/brand/dometic/inverter.html
- https://www.manualslib.com/products/Dometic-Tec29-4416228.html
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=DA_EN&a=http%3a%2f%2fwww.birgersbilligebilboeger.dk%2fhaynes-vaerkstedsboger-og-lign%2fbiler%2f
- https://www.youtube.com/results
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000047d1.bin644e54c1693af48c3c41b43206f32cb2b6769a2707d15f6dda6df465c0587489 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x47D1 | 10740 bytes |
font_01_sfnt_off000069db.bin36692e71212068047e1b4e6f44fa3750b19a6b066afcfc6c3a06f59434dcc665 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x69DB | 6892 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.