MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains heuristics indicating it is a fake download lure, specifically designed for SEO poisoning. The embedded URLs point to a domain that is likely hosting a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.9165
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=the-infidel-stain.pdf PDF link annotation
- http://uncpbisdegree.com/download4.php?q=the-infidel-stain.pdfIn PDF document text
- http://ministry127.com/resources/illustrations/graceIn PDF document text
- http://www.ratsnakefoundation.org/2015/2015_honda_cbr125r_owners_manual.pdfIn PDF document text
- http://www.sjparris.com/article.php?t=theIn PDF document text
- http://www.enhancemyvocabulary.com/synonyms.htmlIn PDF document text
- http://zompist.com/arabic.htmlIn PDF document text
- http://salem-news.com/articles/october022009/hanoi_john_10-2-09.phpIn PDF document text
- http://catallaxyfiles.com/2018/02/15/lets-recriminalise-adultery/In PDF document text
- http://www.sermonnotebook.org/romans/RomIn PDF document text
- http://www.mofak.com/gunny_bush.htmIn PDF document text
- http://positivewordsresearch.com/list-of-negative-words/In PDF document text
- http://www.jesus-is-savior.com/GreatIn PDF document text
- http://ourladysresistance.org/index.htmlIn PDF document text
- http://mashumba.com/english_shona1410.aspxIn PDF document text
- http://smriti.com/urdu/urdu.dictionary.htmlIn PDF document text
- http://www.khamush.com/divani_shams.htmIn PDF document text
- http://riverside-resort.net/1/what-is-the-what.pdfIn PDF document text
- http://riverside-resort.net/1/vw-polo-2018-owners-manuel.pdfIn PDF document text
- http://riverside-resort.net/1/whats-a-century.pdfIn PDF document text
- http://riverside-resort.net/1/waec-answers-to-chemistry-practical-alternative-b.pdfIn PDF document text
- http://uncpbisdegree.com/1/solution-manual-ken-martin.pdfIn PDF document text
- http://riverside-resort.net/1/what-is-grade12-2018-economics-paper2-final-scope.pdfIn PDF document text
- http://riverside-resort.net/1/waac-answer-on-economics.pdfIn PDF document text
- http://uncpbisdegree.com/1/stryker-1188-manual.pdfIn PDF document text
- http://riverside-resort.net/1/volvo-v40-anchor-points-diagram.pdfIn PDF document text
- http://riverside-resort.net/1/uss-theodore-roosevelt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.thesaurus.com/browse/profaneIn PDF document text
- http://www.constitution.org/tp/afri.htmIn PDF document text
- http://www.benchmade.com/griptilian-family.htmlIn PDF document text
- http://tvtropes.org/pmwiki/pmwiki.php/Characters/AstroCityIn PDF document text
- http://www.newadvent.org/cathen/i.htmIn PDF document text
- http://www.newadvent.org/cathen/In PDF document text
- http://www.wowhead.com/quest=25333/might-of-the-sentinelsIn PDF document text
- https://en.wikipedia.org/wiki/Circassian_beautiesIn PDF document text
- http://www.newadvent.org/cathen/01181a.htmIn PDF document text
- http://www.newadvent.org/cathenIn PDF document text
- http://www.newadvent.org/cathen/a.htmIn PDF document text
- http://www.nybooks.com/articles/2016/04/07/brilliant-troubled-dorothy-parker/In PDF document text
- http://www.pbs.org/godinamerica/god-in-the-white-house/In PDF document text
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
- https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000049ae.bin049a718014f58b4ca6bc720829332ac05b0f70e7bd073ad3e907ca4271dee631 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x49AE | 9736 bytes |
font_01_sfnt_off000068c4.bincc01c8088396eb0e121d728d4d4b09da40288e7b9de9407f69617e051ce6fd5a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x68C4 | 6596 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.