MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file is identified as malicious by an ML classifier and contains heuristics indicating it's a fake download lure using SEO poisoning. The document body and extracted URLs point to a deceptive download page designed to trick users into downloading a file disguised as a software manual. The primary malicious URLs are http://uncpbisdisgree.com/download3.php?q=switching-to-the-mac-the-missing-manual-snow-leopard-edition.pdf and http://uncpbisdisgree.com/download4.php?q=switching-to-the-mac-the-missing-manual-snow-leopard-edition.pdf.
Machine Learning
- Nyx PDF Classifier malicious score 0.9062
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=switching-to-the-mac-the-missing-manual-snow-leopard-edition.pdf
- http://uncpbisdegree.com/download4.php?q=switching-to-the-mac-the-missing-manual-snow-leopard-edition.pdf
- http://lowendmac.com/2006/imac-early-2006/
- http://chameleon.osx86.hu/articles/chameleon-20-rc3-with-snow-leopard-and-large-disk-support
- http://lowendmac.com/2004/17-powerbook-g4-1-5-ghz-mid-2004/
- http://www.megaseg.com/faq
- http://www.musitek.com/SSX2Manual/Using_SmartScore_X2.html
- http://www.applefool.com/se30/
- http://wiki.desmume.org/index.php?title=Faq
- https://www.totalphase.com/support/articles/200424386-Data-Center-Software-User-Manual
- https://www.ptgui.com/versionhistory.html
- http://torrentz.eu/search.html
- http://www.cambridgesoft.com/services/SupportNews/rss/Default.aspx
- http://www.newselfpublishing.com/blog/
- http://www.dvddemystified.com/dvdfaq.html
- http://riverside-resort.net/1/the-dark-box-a-secret-history-of-confession.pdf
- http://riverside-resort.net/1/the-complete-siberian-husky-book-of-the-breed-series.pdf
- http://riverside-resort.net/1/the-confessions-of-a-poacher.pdf
- http://riverside-resort.net/1/teachers-guide-of-class-6-of-apsacs.pdf
- http://riverside-resort.net/1/the-secret-life-of-damian-spinelli-as-told-to-diane-miller-carolyn-hennesy.pdf
- http://riverside-resort.net/1/service-workshop-manual-engine-mitsubishi-6d14.pdf
- http://riverside-resort.net/1/the-chording-of-t-o-malone.pdf
- http://riverside-resort.net/1/tsk-uf3000-prober-manual.pdf
- http://riverside-resort.net/1/the-dynamics-of-managing-diversity.pdf
- http://riverside-resort.net/1/the-scarpetta-collection-volume-i-postmortem-and-body-of-evidence-kay-scarpetta.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://www.algoriddim.com/djay-pro-mac/releasenotes
- https://support.apple.com/
- https://www.ep.com/home/support/movie-magic-scheduling/
- https://www.informationweek.com/default.asp
- https://en.wikipedia.org/wiki/Firefox_version_history
- https://www.raspberrypi.org/blog/pixel-pc-mac/
- https://www.psychologytoday.com/us/blog/inside-the-box/201402/thinking-outside-the-box-misguided-idea
- https://www.amazon.com/Logitech-Gaming-Backlit-Programmable-Buttons/dp/B0086UK7IQ
- https://www.amazon.com/Computer-Keyboards-Mice-Accessories/b?ie=UTF8&node=11548956011
- https://www.amazon.com/Mice-Keyboards-Computer-Add-Ons-Computers/b?ie=UTF8&node=11036491
- http://cn.creative.com/support/downloads/download.asp?searchString=s
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=ZH-CHS_EN&a=http%3a%2f%2fcn.creative.com%2fsupport%2fdownloads%2fdownload.asp%3fsearchString%3ds
- https://epson.com/Support/sl/s
- http://tvtropes.org/pmwiki/pmwiki.php/Main/DamnYouMuscleMemory
- https://www.amazon.com/Logitech-Spectrum-Shifting-Personalized-Programmable/dp/B019OB663A
- http://www.loot.co.za/index/html/index4175.html
- http://go.microsoft.com/fwlink/?LinkID=617350
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005384.bin1548f8de70c011d47befc69bb00e039912bfcf28124041a0d7dfa70cb757473e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5384 | 10360 bytes |
font_01_sfnt_off00007475.bin9b04cf75451d9d72591973344d822bff69e2e26edfb9bbe88b70cc1e0eff62be |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7475 | 7152 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.