Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=the-pvc-project-book-101-uses-for-pvc-pipe-in-the-home-garden-farm-and-workshop.pdf

  • http://uncpbisdegree.com/download4.php?q=the-pvc-project-book-101-uses-for-pvc-pipe-in-the-home-garden-farm-and-workshop.pdf
  • http://www.pvcworkshop.com/PVCbookstore.htm
  • http://diyshedplanseasy.com/build-a-steve-redmond-boat/8x12-canvas-print=pb17582/
  • http://howtobuildsheddiy.com/plans.for.cedar.picnic.table/diy.sawhorse.desk.plans=rc3258/
  • http://diygardenshedplansez.com/cost-of-a-storage-shed/used-resin-storage-sheds=cg8245/
  • http://www.backwoodshome.com/features/author-index/
  • http://www.naturalbuildingblog.com/bulletin-board/
  • http://www.architecture.com.au/cpd-education/national/refuel
  • http://torrentz.eu/search.html
  • http://www.cablesfarm.co.uk/
  • https://www.lynneknowlton.com/diy-grapevine-lighting-balls-what-a-bright-idea/
  • http://www.agardenforthehouse.com/2009/06/ask-kevin/
  • http://www.hornywhores.net/
  • http://www.forwarders.com/tradeforum/tradeforum.html
  • http://hamburggermany.men/Hamburg-Germany/Hamburg-Germany_bb.php
  • http://truckwaale.com/enquiry/
  • https://www.greenoptimistic.com/free-energy-magnetic-motor/
  • http://riverside-resort.net/1/tarbuck-and-lutgens-earth-science-answers.pdf
  • http://riverside-resort.net/1/springboard-for-11th-grade-english.pdf
  • http://riverside-resort.net/1/the-work-of-hipgnosis-walk-away-rene.pdf
  • http://riverside-resort.net/1/the-advisory-book.pdf
  • http://riverside-resort.net/1/solution-manual-discrete-event-simulation-jerry-4.pdf
  • http://riverside-resort.net/1/supplemental-problems-physics-answers.pdf
  • http://riverside-resort.net/1/solution-11-167-the-book-of-scotlands.pdf
  • http://riverside-resort.net/1/the-lone-woman-of-san-nicolas-island.pdf
  • http://riverside-resort.net/1/the-comeback.pdf
  • http://riverside-resort.net/1/the-complete-pokmon-pocket-guide-book.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://www.ebay.com/gds
  • http://procurement-notices.undp.org/search.cfm?order_by=deadline
  • http://dupontinvestigation.blogspot.com/2014/02/dupont-investigation-following.html
  • https://www.scribd.com/document/181932008/500-Business-Ideas-pdf
  • http://blogs.discovermagazine.com/realitybase/2008/07/22/charged-with-a-crime-better-check-your-facebook-pictures/
  • http://www.dictionary.com/e/s/word-of-the-year-list/
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
  • https://go.microsoft.com/fwlink/?linkid=868922
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
  • http://go.microsoft.com/fwlink/?LinkID=617297
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Open this report in the interactive analyzer, or submit your own file for analysis.