Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=weather-and-climate-through-infographics.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=weather-and-climate-through-infographics.pdfIn PDF document text
  • https://www.environmentalsciencedegree.com/climate-change/In PDF document text
  • http://www.climatecouncil.org.au/In PDF document text
  • https://homafiles.info/In PDF document text
  • https://www.science.org.au/curious/earth-environment/climate-change-and-human-healthIn PDF document text
  • https://www.science.org.au/curiousIn PDF document text
  • https://www.science.org.au/curious/category/earth-environmentIn PDF document text
  • http://www.cowspiracy.com/facts/In PDF document text
  • http://ictcompliance.com/blog/the-87-best-blogs-for-treehuggers-and-climate-change-warriors/In PDF document text
  • http://www.halcyonmaps.com/In PDF document text
  • http://www.psandman.com/gst2011.htmIn PDF document text
  • http://www.overpopulation.org/solutions.htmlIn PDF document text
  • http://uncpbisdegree.com/1/tcs-aptitude-question-paper-2015-with-answers.pdfIn PDF document text
  • http://riverside-resort.net/1/youre-never-alone.pdfIn PDF document text
  • http://riverside-resort.net/1/vocabulary-unit-h-answers.pdfIn PDF document text
  • http://riverside-resort.net/1/wurtzite-boron-nitride-and-lonsdaleite.pdfIn PDF document text
  • http://uncpbisdegree.com/1/solutions-for-land-pollution.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-first-pup-the-real-story-of-how-bo-got-to-the-white-house.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-immortals-book-2-battle-of-the-ancients.pdfIn PDF document text
  • http://uncpbisdegree.com/1/texas-history-workbook-7th-grade.pdfIn PDF document text
  • http://uncpbisdegree.com/1/social-studies-eog-released-paper-nc.pdfIn PDF document text
  • http://riverside-resort.net/1/whale-watching-cassette-book.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://www.carbonbrief.org/mapped-how-climate-change-affects-extreme-weather-around-the-worldIn PDF document text
  • https://www.wunderground.com/cat6In PDF document text
  • https://climate.nasa.gov/In PDF document text
  • http://www.nsta.org/publications/article.aspxIn PDF document text
  • http://www.grida.no/resources?media=GraphicIn PDF document text
  • https://www.statista.com/topics/1148/global-climate-change/In PDF document text
  • https://www.statista.com/markets/408/energy-environmental-services/In PDF document text
  • https://www.statista.com/markets/408/topic/949/emissions/In PDF document text
  • http://www.printmag.com/design-education/online-design-courses/14-reliable-data-sources-for-your-infographics/In PDF document text
  • https://www.statista.com/chart/9656/the-state-of-the-paris-agreement/In PDF document text
  • https://www.statista.com/topics/In PDF document text
  • https://www.epa.gov/sites/production/files/signpost/cc.htmlIn PDF document text
  • https://insideclimatenews.org/news/03102017/infographic-ocean-heat-powerful-climate-change-evidence-global-warmingIn PDF document text
  • https://www.livescience.com/topics/global-warmingIn PDF document text
  • http://www.who.int/globalchange/resources/toolkit/en/In PDF document text
  • http://www.who.int/globalchange/resources/en/In PDF document text
  • https://www.nationalgeographic.com/magazine/In PDF document text
  • https://www.carbonbrief.org/cop23-key-outcomes-agreed-un-climate-talks-bonnIn PDF document text
  • https://www.naturalnews.com/2017-09-10-claim-hurricane-irma-a-man-made-storm-created-via-weather-weaponization-technology-new-video-released.htmlIn PDF document text
  • http://www.scmp.com/news/china/society/article/2138866/china-needs-more-water-so-its-building-rain-making-network-threeIn PDF document text
  • http://www.nsc.org/In PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text

  +3 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.