PDF static analysis report

Static analysis result for SHA-256 65227b33f44d07f7…

SUSPICIOUS

PDF

76.6 KB Created: 2018-06-11 08:28:57 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-24
MD5: 587555522315078cf1b2d4d91403cd65 SHA-1: 8c9ac870cf21d13745e9730fc2219d51d89ee697 SHA-256: 65227b33f44d07f71b4325499e0e029ee26c61e80face4bafcfdaefb02bbda8e
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0474

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-mayflower-descendant-volume-11-a-quarterly-magazine-of-pilgrim-genealogy-and-history.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=the-mayflower-descendant-volume-11-a-quarterly-magazine-of-pilgrim-genealogy-and-history.pdfIn PDF document text
    • https://www.americanancestors.org/browse/publications/mayflower-descendantIn PDF document text
    • https://www.massmayflower.org/index.php/research-resources-education/books-and-articlesIn PDF document text
    • https://www.themayflowersociety.org/In PDF document text
    • http://riverside-resort.net/1/sipser-solution-manual-rar.pdfIn PDF document text
    • http://riverside-resort.net/1/smartphone-accelerometer-controlled-automated-wheelchair.pdfIn PDF document text
    • http://riverside-resort.net/1/siemens-dishwasher-user-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/shortlist-egerton-university-2018-intake.pdfIn PDF document text
    • http://riverside-resort.net/1/the-princess-and-the-dragon-childs-play-library.pdfIn PDF document text
    • http://riverside-resort.net/1/the-hanged-man.pdfIn PDF document text
    • http://riverside-resort.net/1/two-step-equations-worksheet-with-answer-key.pdfIn PDF document text
    • http://riverside-resort.net/1/the-king-amp.pdfIn PDF document text
    • http://riverside-resort.net/1/tahoe-06-repair-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/tribology-in-manufacturing-technology.pdfIn PDF document text
    • https://www.americanancestors.org/.../mayflower-descendantIn PDF document text
    • https://www.massmayflower.org/.../books-and-articlesIn PDF document text
    • https://www.themayflowersociety.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://archive.org/details/mayflowerdescen00descgoogIn PDF document text
    • https://archive.org/details/mayflowerdescendv2massIn PDF document text
    • https://www.amazon.com/Mayflower-Descendant-Quarterly-Magazine-Genealogy/dp/134645082XIn PDF document text
    • https://www.amazon.com/books-used-books-textbooks/b?ie=UTF8&node=283155In PDF document text
    • https://www.amazon.com/History-Books/b?ie=UTF8&node=9In PDF document text
    • https://www.amazon.com/World-History-Books/b?ie=UTF8&node=5035In PDF document text
    • https://books.google.com/books/about/The_Mayflower_Descendant.html?id=q8AUAAAAYAAJIn PDF document text
    • https://catalog.hathitrust.org/Record/009030439In PDF document text
    • https://www.amazon.com/Mayflower-Descendant-Quarterly-Magazine-Genealogy/dp/B00A9LRWGUIn PDF document text
    • https://www.amazon.com/Education-Reference-Books/b?ie=UTF8&node=21In PDF document text
    • https://www.amazon.com/Genealogy-Reference-Books/b?ie=UTF8&node=11880In PDF document text
    • https://www.abebooks.com/book-search/isbn/0788405470/In PDF document text
    • https://www.abebooks.com/book-search/isbn/0788405489/In PDF document text
    • https://jet.com/product/The-Mayflower-Descendant-A-Quarterly-Magazine-Of-Pilgrim-Genealogy-And-History-V/a16e21c6ea6d4a7db7f5ebd858299a3aIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://books.google.com/books/about/The_Mayflower_Descendant.htmlIn PDF document text
    • https://www.abebooks.com/book-search/isbn/0788405470In PDF document text
    • https://www.abebooks.com/book-search/isbn/0788405489In PDF document text
    • https://jet.com/product/The-Mayflower-Descendant-A-QuarterlyIn PDF document text
    • https://www.bing.com/aclick?ld=d3qmKHIV2SyHhDt1tO1YKtaTVUCUyint_LAQmvXQ9axPj8XHGhZNy5u2JOF-RiPaKdv7SngTnKN-E_Uojiv-5zhBk1q4aKXIta7X4amh6hMyrx-aVKiMXoowVKynzk2tFuMh11TB1BcksX-fFGfEBpsd8hY7dmnkWX2FE0oud_F4S32hNi&u=https%3a%2f%2fwww.walmart.com%2fip%2fThe-Mayflower-Descendant-A-Quarterly-Magazine-of-Pilgrim-Genealogy-and-History-Volume-21%2f700717819%3fwmlspartner%3dwlpa%26selectedSellerId%3d10751%26adid%3d22222222222097820826%26wmlspartner%3dwmtlabs%26wl0%3de%26wl1%3do%26wl2%3dc%26wl3%3d74491979742351%26wl4%3dpla-4578091549958463%26wl5%3d%26wl6%3d%26wl7%3d%26+wl10%3dWalmart%26wl12%3d700717819_10000011140%26wl14%3dthe%2520mayflower%2520descendant%2520volume%252011%2520a%2520quarterly%2520magazine%2520of%2520pilgrim%2520genealogy%2520and%2520history%26veh%3dsemIn PDF document text
    • https://www.bing.com/aclick?ld=d3vGsNjRxo_TiSWk9yanoaWjVUCUxDeHo5VXTnBPN5-_JCaCyIRSl1wuY_pbLtKtFU0PL-mL8QG6SB3bA5IV0ukX0Cg3VX_QGzZ5Bl_JhylGIOyCDp31IVnmdBop8FxtZ2GBpFHX9uLouZMUHzl0tPf00s98uTgjbafRUHSbRoFr9__qtD&u=https%3a%2f%2fwww.walmart.com%2fip%2fMayflower-Descendant-A-Quarterly-Magazine-of-Pilgrim-Genealogy-and-History-Volume-2%2f867841711%3fwmlspartner%3dwlpa%26selectedSellerId%3d10751%26adid%3d22222222222099818946%26wmlspartner%3dwmtlabs%26wl0%3de%26wl1%3do%26wl2%3dc%26wl3%3d75385334129995%26wl4%3dpla-4578984906581238%26wl5%3d%26wl6%3d%26wl7%3d%26+wl10%3dWalmart%26wl12%3d867841711_10000011140%26wl14%3dthe%2520mayflower%2520descendant%2520volume%252011%2520a%2520quarterly%2520magazine%2520of%2520pilgrim%2520genealogy%2520and%2520history%26veh%3dsemIn PDF document text
    • https://www.bing.com/aclick?ld=d3jjmv8ttwRW3ADFkYfdyi9TVUCUyPs9wB7DLjtFS9aEoP4_mIGH90CpiljC8VSonjjXjziB-09Xl-pTgHrVsx_U0NX3wKFXmnry68OPPp3UkGL5iRNtiOu4YUY6cmg8aIsl0bhjz96m-TEptV7k_PaMQA8F8H6KuDLWh12mLngg-dV8NA&u=http%3a%2f%2ftracker.marinsm.com%2frd%3fcid%3dsnl9t30fh0%26lp%3dhttps%3a%2f%2fwww.thriftbooks.com%2fw%2fthe-mayflower-descendant-a-quarterly-magazine-of-pilgrim-genealogy-and-history-volume-17_massachusetts-society-of-mayflower-descendants%2f15569045%2f%3fisbn%3d1148809678%26idiq%3d21979650%2526mkwid%253DVp0rZzwJ%257Cdc%2526pcrid%253D11558858428%26utm_source%3dbing%26utm_medium%3dcpc%26utm_campaign%3dBing%2520Shopping%2520%257C%2520History%26utm_term%3d1101002859940%26utm_content%3dHistoryIn PDF document text
    • https://www.bing.com/aclick?ld=d3q9Q7R6Ku1APD4rVTrGRRZDVUCUxCosBw5W4HjxBO7AlmTNX3qtJcObVuZQRFKZFQ-xK31sc8v8cX75hwq_ZtqM0v0g-bVwCoK-axb8DTFbRMYUMbSDclDQfRD5ypRRU3AuGFE8xzSqh5jC5Kk7gEfZwXp7Qg3SMkNeS_5pVGFu40pEUj&u=http%3a%2f%2ftracker.marinsm.com%2frd%3fcid%3dsnl9t30fh0%26lp%3dhttps%3a%2f%2fwww.thriftbooks.com%2fw%2fthe-mayflower-descendant-1620-1920-a-quarterly-magazine-of-pilgrim-genealogy-and-history-volumes-12-13%2f12797666%2f%3fisbn%3d1340622149%26idiq%3d26549119%2526mkwid%253DVp0rZzwJ%257Cdc%2526pcrid%253D11558858428%26utm_source%3dbing%26utm_medium%3dcpc%26utm_campaign%3dBing%2520Shopping%2520%257C%2520History%26utm_term%3d1101002859940%26utm_content%3dHistoryIn PDF document text
    • https://www.bing.com/aclick?ld=d3Fi_FrVneoO51yAvtV18XezVUCUzw8UCWv46Yg7zjdT_OGVFAnvnrB8QI-tWtlA3M7ZpsT_4BpLizA_N9GN4rLtFJ-kxk5DOM-c2feUCiF3Ir0BmkDZiRHH7ntrbTHDrkNKXDUIx08IKq3ZLgnsimkFgV1x5pnPkbp-iDK2WVJp60yQpv&u=http%3a%2f%2ftracker.marinsm.com%2frd%3fcid%3dsnl9t30fh0%26lp%3dhttps%3a%2f%2fwww.thriftbooks.com%2fw%2fthe-mayflower-descendant-v16--a-quarterly-magazine-of-pilgrim-genealogy-and-history-1914%2f13273563%2f%3fisbn%3d1165542099%26idiq%3d17771662%2526mkwid%253DHQtBD9yx%257Cdc%2526pcrid%253D11558792766%26utm_source%3dbing%26utm_medium%3dcpc%26utm_campaign%3dBing%2520Shopping%2520%257C%2520Everything%2520Else%26utm_term%3d1101002858882%26utm_content%3dEverything%2520ElseIn PDF document text
    • https://www.bing.com/aclick?ld=d3iCFemtTyl2DFB0uWd4sjNjVUCUziGMYPmHPvVulBYCFLJrzg9CoY4gz5cy0FHjU3me02jDEsdZOjwx9_h01FaCiY3E80WgLb_6GRTunFq9-5q_D6zTASWskd4naBZmnsdEL23D6C9dlIb3nHXAqULzcMRJl3zMoMw1p25mx0yeoICnrY&u=http%3a%2f%2f5022.xg4ken.com%2ftrk%2fv1%3fprof%3d3%26camp%3d13622468%26affcode%3dpg209796%26kct%3dmsn%26kchid%3d1055003%26cid%3d77240738024322%26kdv%3dc%26kpid%3d9781451529975%26criteriaid%3dpla-4580840320604806%26queryStr%3dthe%2520mayflower%2520descendant%2520volume%252011%2520a%2520quarterly%2520magazine%2520of%2520pilgrim%2520genealogy%2520and%2520history%26adgroupid%3d1235851163945930%26campaignid%3d279358633%26locphy%3d%26url%3dhttps%3a%2f%2fwww.barnesandnoble.com%2fw%2fthe-mayflower-descendant-george-ernest-bowman%2f1021152793%3fean%3d9781451529975%26st%3dPLA%26sid%3dBNB_DRS_New%2bCore%2bShopping%2bBooks_00000000%262sid%3dBing_e%26sourceId%3dPLBiP209796%26msclkid%3d%7bmsclkid%7dIn PDF document text
    +1 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d773.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD773 15012 bytes
SHA-256: a164ca197f4a939b8b909cf2ce6ac02f08fbc1b745ddf6c87daf9211bc8784a0
font_01_sfnt_off00010539.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10539 11052 bytes
SHA-256: 3cb6317f292c8bfdd245edeb7c3990374a6b06dc52bfe8d191931795abcfa765