MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains embedded URLs and a heuristic firing for an external URI, specifically pointing to 'uncpbisdegree.com'. The document body, though partially garbled, includes references to an art exhibition and download links, suggesting a lure to trick the user into downloading a malicious file. The ML classifier also flagged this PDF as malicious with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.9340
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARMPDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=the-1992-international-invitational-exhibition-of-contemporary-ceramic-art.pdf In PDF document text
- http://uncpbisdegree.com/download4.php?q=the-1992-international-invitational-exhibition-of-contemporary-ceramic-art.pdfIn PDF document text
- http://www.magdaleneodundo.com/resume.htmlIn PDF document text
- http://watson-fitzgerald.com/In PDF document text
- http://www.kondo-kyoto.com/About/IndexIn PDF document text
- https://532gallery.com/artists/In PDF document text
- https://532gallery.com/postindex/In PDF document text
- http://joanmitchellfoundation.org/work/artist/bioIn PDF document text
- https://gadsdenarts.org/exhibitionsIn PDF document text
- http://www.ohimuseum.com/11th_toshio/profile.htmlIn PDF document text
- http://lichtensteinfoundation.org/chronology-2/In PDF document text
- http://www.artgalleryofalgoma.com/main-gallery-exhibitions.htmlIn PDF document text
- http://mexic-artemuseum.org/exhibitions/In PDF document text
- http://lichtensteinfoundation.org/exhibition-history/In PDF document text
- http://biotechnics.org/artists.htmlIn PDF document text
- http://bridgeport-art-trail.org/artist-of-the-month-2/In PDF document text
- http://www.digitalthistle.org/type/aside/In PDF document text
- http://www.exonumia.com/sale11/alla.htmIn PDF document text
- http://hamburggermany.men/Hamburg-Germany/Hamburg-Germany_bq.phpIn PDF document text
- http://uncpbisdegree.com/1/template-for-a-training-manual.pdfIn PDF document text
- http://riverside-resort.net/1/usury-statute.pdfIn PDF document text
- http://riverside-resort.net/1/unnatural-selections-a-far-side-collection.pdfIn PDF document text
- http://riverside-resort.net/1/user-manual-for-lg-tone-hbs700.pdfIn PDF document text
- http://riverside-resort.net/1/wireless-lan-systems.pdfIn PDF document text
- http://uncpbisdegree.com/1/the-complete-book-of-pregnancy-amp-childbirth-sheila-kitzinger.pdfIn PDF document text
- http://uncpbisdegree.com/1/suzuki-outboard-spc-schematic.pdfIn PDF document text
- http://uncpbisdegree.com/1/sony-mvc-cd250-digital-cameras-owners-manual.pdfIn PDF document text
- http://riverside-resort.net/1/what-is-ipad-resolution.pdfIn PDF document text
- http://uncpbisdegree.com/1/sparks-3-workbook-answers.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=JA_EN&a=http%3a%2f%2fwww.ohimuseum.com%2f11th_toshio%2fprofile.htmlIn PDF document text
- https://en.wikipedia.org/wiki/University_of_DallasIn PDF document text
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
- https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004751.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4751 | 10592 bytes |
SHA-256: e1ae1e84e3e672f936b13028ac974eabaa6f7c033686a32aabc374d9241f8686 |
|||
font_01_sfnt_off000068f8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x68F8 | 7204 bytes |
SHA-256: 9430228ad218fff02b170a11051b92199c759348ab11082daeba644def5d3751 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.