MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF file was identified as malicious by an ML classifier and contains heuristics indicating it is a fake download lure, likely for SEO poisoning. The document body contains multiple URLs pointing to download locations, with the primary malicious URL being http://uncpbisdegree.com/download3.php?q=vivitar-dvr-545user-manual.pdf. This suggests the file is intended to trick users into downloading a payload disguised as a user manual.
Machine Learning
- Nyx PDF Classifier malicious score 0.8545
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=vivitar-dvr-545user-manual.pdf PDF link annotation
- http://uncpbisdegree.com/download4.php?q=vivitar-dvr-545user-manual.pdfIn PDF document text
- http://static.highspeedbackbone.net/pdf/Vivitar_DVR545_Manual.pdfIn PDF document text
- http://wundoc.de/vivitar/dvr/vivitar_dvr_545user_manual.pdfIn PDF document text
- http://www.vivitar.com/files_products/417/DVR_508_Camera_Manual.pdfIn PDF document text
- http://fmantz.de/vivitar/dvr/vivitar_dvr_545user_manual.pdfIn PDF document text
- http://camera.manualsonline.com/manuals/mfg/vivitar/vivitar_digital_camera_product_list.htmlIn PDF document text
- https://manualsink.com/vivitar-camera-user-manuals.aspxIn PDF document text
- https://manualsink.com/Default.aspxIn PDF document text
- https://manualsink.com/camera-user-manuals.aspxIn PDF document text
- http://camera.manualsonline.com/manuals/mfg/vivitar/vivitar_camcorder_product_list.htmlIn PDF document text
- https://manualsink.com/dvr-Series-C1008.aspxIn PDF document text
- http://uncpbisdegree.com/1/the-questions-within-cutting-edge.pdfIn PDF document text
- http://uncpbisdegree.com/1/wiring-a-toyota-alternator-with-external-regulator.pdfIn PDF document text
- http://uncpbisdegree.com/1/the-war-below-the-story-of-three-submarines-that-battled-japan.pdfIn PDF document text
- http://uncpbisdegree.com/1/volvo-d12-engine-position-sensor.pdfIn PDF document text
- http://uncpbisdegree.com/1/the-persistence-of-modernism-loss-and-mourning-in-the-twentieth-century.pdfIn PDF document text
- http://uncpbisdegree.com/1/the-mindfulness-journal-exercises-to-help-you-find-peace-and-calm-wherever-you-are.pdfIn PDF document text
- http://uncpbisdegree.com/1/ubl-online-complaint.pdfIn PDF document text
- http://uncpbisdegree.com/1/volvo-s60-manual-2000.pdfIn PDF document text
- http://uncpbisdegree.com/1/tomtom-one-wiring-diagram.pdfIn PDF document text
- http://uncpbisdegree.com/1/the-strange-case-of-the-missing-sheep.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://www.manualslib.com/manual/600431/Vivitar-Dvr-550.htmlIn PDF document text
- https://www.manualslib.com/brand/vivitar/In PDF document text
- https://www.manualslib.com/brand/vivitar/camcorder.htmlIn PDF document text
- https://www.manualslib.com/products/Vivitar-Dvr-550-3094210.htmlIn PDF document text
- https://www.manualslib.com/brand/In PDF document text
- https://www.lifewire.com/vivitar-support-2625707In PDF document text
- https://0.r.bat.bing.com/?ld=e3g7LFn87U7zULejAnbF1aJTVUCUwvslY4yCRmxclHxMIKzoWduwqUjlIBXQzqYBC2AaDMY_drMLAI2IEJe2tkJN9SEaHvShDdQ5bqyWx_9TXgzQV2-HV3pyt1yLDUe6cq14hnomTpEew5hmTq2SPugWIezxfsApj7pZoh7n6bMzz2Y1FV&u=d3d3LnByb2R1Y3RtYW51YWxzLm9yZyUyZmxwJTJmJTNmYnJhbmQlM2RWaXZpdGFyJTI2dXRtX3NvdXJjZSUzZGFkY2VudGVyJTI2dXRtX21lZGl1bSUzZGNwYyUyNnV0bV90ZXJtJTNkdml2aXRhciUyNTIwbWFudWFsJTI2dXRtX25ldHdvcmslM2QlN2IlN2QlMjZ1dG1fY2FtcGFpZ24lM2RGTSUyYkJyYW5kcyUyYjAyLTAzJTJiMwIn PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
- https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007ff3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7FF3 | 14348 bytes |
SHA-256: b22a2efc4ecd56fba2d34ade494dcd4641b8441513e6581d1657439997bfa349 |
|||
font_01_sfnt_off0000ac03.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAC03 | 9588 bytes |
SHA-256: 77aff5d05c7c9d628b60c8c00ddf7cc49ccded072a38d128aae61f0d80dad70f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.