MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains heuristics indicating it is a fake 'free download' SEO-poisoning document. It embeds URLs that mimic search results for academic materials, specifically a solution manual, to trick users into clicking. The primary malicious URL identified is http://uncpbisdegree.com/download3.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf, which likely serves as a gateway to a further payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9202
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf
- http://uncpbisdegree.com/download4.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf
- http://www.pageinsider.com/
- http://www.ijera.com/pages/v3no4.html
- https://1mbed.com/
- http://www.critcononline.com/action.htm
- http://riverside-resort.net/1/what-wildness-is-this-women-write-about-the-southwest.pdf
- http://riverside-resort.net/1/visiting-card-design-for-home-appliances.pdf
- http://uncpbisdegree.com/1/the-gods-of-greeks-karl-kerenyi.pdf
- http://uncpbisdegree.com/1/the-amazing-spider-man-free-comic-book-day-2011.pdf
- http://uncpbisdegree.com/1/student-council-interview-answers.pdf
- http://uncpbisdegree.com/1/suzuki-baleno-engine-diagram-1995.pdf
- http://uncpbisdegree.com/1/t-mobile-phone-repair-centers.pdf
- http://uncpbisdegree.com/1/the-bingo-palace.pdf
- http://uncpbisdegree.com/1/solution-manual-cyber-exploration.pdf
- http://riverside-resort.net/1/yamaha-v-star-1300-deluxe-manual.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.facebook.com/photo.php
- http://www.loot.co.za/index/html/index3385.html
- http://www.loot.co.za/index/html/index231.html
- https://www.nytimes.com/search
- https://www.youtube.com/results
- https://www.telegraph.co.uk/news/
- http://music.163.com/
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=ZH-CHS_EN&a=http%3a%2f%2fmusic.163.com%2f
- https://www.google.com/?gws_rd=ssl
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2f1mbed.com%2f
- http://theconversation.com/articles.atom
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000043e2.bin7e52ba893dc3f5ab69fc797e7ae5eb3a9b76ab7a9f2a281ef0afb141865b223f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x43E2 | 10512 bytes |
font_01_sfnt_off0000653e.bin1be68246f7293d11cdac722b58d95681b31369a1a11e3c647fe7c8780fb5d9b9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x653E | 7376 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.