Malicious PDF — malware analysis report

Heuristics 4

• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=word-2007-macros-vba-made-easy-made-easy-series.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=word-2007-macros-vba-made-easy-made-easy-series.pdfIn PDF document text
  • http://habnix.de/word/2007/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • http://smilye.de/word/2007/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • https://theraceplace.co.uk/books/1d47f9/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • http://wixbox.de/word/2007/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • http://www.boswellwrites.com/word-2007-macros-vba-made-easy-made-easy-series-english.pdfIn PDF document text
  • http://tusoft.de/word-2007-macros-&-vba-made-easy-made-easy-series.pdfIn PDF document text
  • http://www.euorangecounty.com/word/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • http://www.abvilrealty.com/word_2007_macros_vba_made_easy_made_easy_series.pdfIn PDF document text
  • http://www.vrlagelbattery.com/word/word-2007-macros-vba-made-easy-made-easy-series-english.pdfIn PDF document text
  • http://www.houseplangirl.com/reads-online/word-2007-macros-vba-made-easy-made-easy-series.pdfIn PDF document text
  • http://riverside-resort.net/1/usa-test-prep-miduim-test-answer-key.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-book-of-liverpool-a-city-in-short-fiction.pdfIn PDF document text
  • http://uncpbisdegree.com/1/study-guide-and-solutions-manual-to-accompany-organic-chemistry.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-cutting-book-the-official-guide-to-cutting-at-s-nvq-levels-2-and-3.pdfIn PDF document text
  • http://uncpbisdegree.com/1/tablet-screen-repair-cost.pdfIn PDF document text
  • http://riverside-resort.net/1/universal-studios-florida-fan-club.pdfIn PDF document text
  • http://riverside-resort.net/1/vivian-maier-self-portrait.pdfIn PDF document text
  • http://uncpbisdegree.com/1/state-of-oregon-medication-aide-study-guide.pdfIn PDF document text
  • http://uncpbisdegree.com/1/service-manual-for-ybr-250.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-beginners-guide-to-fixing-your-pc-how-to-solve-the-commonest-computer-problems.pdfIn PDF document text
  • https://theraceplace.co.uk/books/1d47f9/word_2007_macros_vba_madeIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://www.amazon.com/Word-2007-Macros-Made-Easy/dp/0071614796In PDF document text
  • https://www.amazon.com/books-used-books-textbooks/b?ie=UTF8&node=283155In PDF document text
  • https://www.amazon.com/Computers-Technology-Books/b?ie=UTF8&node=5In PDF document text
  • https://www.amazon.com/Software-Computers-Internet-Books/b?ie=UTF8&node=4053In PDF document text
  • https://141019213.r.bat.bing.com/?ld=d38pEhZpte1KAPEqxQSUO25jVUCUwQjKq-Ksn0hgj-7_0BzaVKyEKTNj6O9kCozvo8OfzFfCzMN2j6X7q_eTvnT7xdAzFUcf8dgrWhXPAtnBzNY5F58yV-jNS6PSPsiWe3QuKGh7StZSsKGZuSEkzcgAmFE8aes4zax2ZoZ5PExmw7h8Dy&u=https%3a%2f%2fwww.vitalsource.com%2fproducts%2fword-2007-macros-amp-vba-made-easy-guy-hart-davis-v9780071614801%3fduration%3dperpetual%26utm_source%3dbing%26utm_medium%3dcpc%26utm_campaign%3d%26msclkid%3d%7bmsclkid%7dIn PDF document text
  • https://www.amazon.com/Word-2007-Macros-Made-Easy/product-reviews/0071614796In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
  • https://www.amazon.com/Word-2007-Macros-Made-Easy/product-reviews/In PDF document text
  • https://61000009.r.bat.bing.com/?ld=d3UGJl8yfCAfdbnEFrHUu2cjVUCUx6CLoH4JcVBdf9Dylp1Kg6a520eVT9vjMQeZXJ6O02AgTBT-9_QPjm7NW-WMIJEGX_jH529y-4_uc6RfMPOX153R0Hr9hztL3JKHNrlCe4LvCLjPEtgNXgjP5g0ainOI6LaIwTYi0a1FJ7BgLFXONY&u=https%3a%2f%2fwww.walmart.com%2fip%2fWord-2007-Macros-VBA-Made-Easy%2f10194610%3fwmlspartner%3dwlpa%26selectedSellerId%3d14148%26adid%3d22222222222000000000%26wmlspartner%3dwmtlabs%26wl0%3de%26wl1%3do%26wl2%3dc%26wl3%3d10352200394%26wl4%3dpla-1103028060075%26wl12%3d10194610_10000014595%26wl14%3dword%25202007%2520macros%2520vba%2520made%2520easy%2520made%2520easy%2520series%26veh%3dsem%26msclkid%3d%7bmsclkid%7dIn PDF document text
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.