Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=small-giants-companies-that-choose-to-be-great.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=small-giants-companies-that-choose-to-be-great.pdfIn PDF document text
  • http://www.smallgiantsbook.com/In PDF document text
  • http://www.smallgiantsbook.com/about.htmlIn PDF document text
  • https://smallgiants.org/summit/In PDF document text
  • https://www.venturegiants.com/news-channel-365-how-to-write-the-perfect-investment-proposal---investment-proposal-template.aspxIn PDF document text
  • http://www.snipp.com/blog/2017-07-18/industry-trends-2017-cpg-food/In PDF document text
  • https://www.asecurelife.com/vivint-vs-adt/In PDF document text
  • https://www.asecurelife.com/category/home-security/In PDF document text
  • https://www.asecurelife.com/category/home-security/security-systems/In PDF document text
  • http://thewatcherfiles.com/giants/solomon-giants.htmIn PDF document text
  • https://www.asecurelife.com/protect-america-vs-adt/In PDF document text
  • https://www.heirloomtomatoplants.com/HeirloomIn PDF document text
  • https://www.mdtstraining.com/small-fixed-blade-knives-for-every-day-carry/In PDF document text
  • https://www.clothingdropshipping.com/In PDF document text
  • https://www.crueltyfreekitty.com/bath-body/cruelty-free-perfume/In PDF document text
  • http://riverside-resort.net/1/sony-sdm-e96a-monitors-owners-manual.pdfIn PDF document text
  • http://riverside-resort.net/1/the-wars-of-gods-and-men-earth-chronicles.pdfIn PDF document text
  • http://riverside-resort.net/1/tesco-application-form-2018-answers.pdfIn PDF document text
  • http://riverside-resort.net/1/the-sibley-guide-to-birds-david-allen.pdfIn PDF document text
  • http://riverside-resort.net/1/steam-engine-industrial-revolution.pdfIn PDF document text
  • http://riverside-resort.net/1/tata-hitachi-ex-200-service-manual.pdfIn PDF document text
  • http://riverside-resort.net/1/tempting-fate.pdfIn PDF document text
  • http://riverside-resort.net/1/statics-9th-edition-solutions.pdfIn PDF document text
  • http://riverside-resort.net/1/solution-manual-for-algorithm-design-michael-t-goodrich.pdfIn PDF document text
  • http://riverside-resort.net/1/the-mafia-cookbook-with-37-new-foolproof-recipes-to-die-for.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://www.forbes.com/sites/boburlingham/2017/05/09/forbes-small-giants-2017-americas-best-small-companies/In PDF document text
  • https://www.forbes.com/forbes-live/event/small-giants/In PDF document text
  • https://hbr.org/1999/03/competing-with-giants-survival-strategies-for-local-companies-in-emerging-marketsIn PDF document text
  • https://due.com/blog/top-101-invoicing-companies/In PDF document text
  • https://www.investopedia.com/news/china-woo-foreign-listed-tech-giants-back-home/In PDF document text
  • http://www.thisismoney.co.uk/money/markets/article-5690983/What-outsourcing-companies-distance.htmlIn PDF document text
  • https://abcnews.go.com/businessIn PDF document text
  • https://www.thebalancesmb.com/small-business-advertising-ideas-2947892In PDF document text
  • https://kinsta.com/blog/google-cloud-vs-aws/In PDF document text
  • https://www.schneier.com/blog/archives/2018/03/the_600_compani.htmlIn PDF document text
  • https://abcnews.go.com/technologyIn PDF document text
  • https://www.quora.com/What-is-the-best-business-to-start-in-a-village-or-small-cityIn PDF document text
  • https://www.technologyreview.com/lists/companies/2015/intro/In PDF document text
  • https://www.vanityfair.com/news/2008/05/monsanto200805In PDF document text
  • http://www.thisismoney.co.uk/money/saving/article-3505692/The-seven-different-types-offer-choose-one-you.htmlIn PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.