MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to attract users searching for educational content. The embedded URLs and document body point to the domain 'uncpbisdegree.com', which is likely hosting a malicious payload disguised as a PDF. The ML classifier also flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9395
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=what-is-a-fraction.pdf PDF link annotation
- http://uncpbisdegree.com/download4.php?q=what-is-a-fraction.pdfIn PDF document text
- http://www.gamequarium.com/fractions.htmlIn PDF document text
- http://www.bgfl.org/bgfl/custom/resources_ftp/client_ftp/ks2/maths/fractions/index.htmIn PDF document text
- http://www.aaamath.com/fra.htmlIn PDF document text
- https://www.fractionltd.com/In PDF document text
- http://www.numeracyhelper.com/fractionwalls/In PDF document text
- http://www.math.com/school/subject1/practice/S1U4L5/S1U4L5Pract.htmlIn PDF document text
- http://www.elainefitzgerald.com/jeopardyfractions.pptIn PDF document text
- http://monocleyachts.com/In PDF document text
- http://www.superstructure.com/In PDF document text
- http://riverside-resort.net/1/simpsons-comic-book-guy-video.pdfIn PDF document text
- http://riverside-resort.net/1/the-parents-guide-to-successful-homeschooling.pdfIn PDF document text
- http://riverside-resort.net/1/suzuki-swift-owners-manual-cars.pdfIn PDF document text
- http://riverside-resort.net/1/solution-manual-cmos-vlsi-design-4th-edition.pdfIn PDF document text
- http://riverside-resort.net/1/the-book-of-basketball-nba-according-to-sports-guy-bill-simmons.pdfIn PDF document text
- http://riverside-resort.net/1/smoothies-for-lung-cancer-patients.pdfIn PDF document text
- http://riverside-resort.net/1/smithsonian-handbooks-fossils.pdfIn PDF document text
- http://riverside-resort.net/1/tuntematon-tekij.pdfIn PDF document text
- http://riverside-resort.net/1/the-spectatorship-of-suffering.pdfIn PDF document text
- http://riverside-resort.net/1/solution-of-digital-logic-computer-design-by-morris-mano.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://nlvm.usu.edu/en/nav/frames_asid_104_g_1_t_1.htmlIn PDF document text
- http://www.visualfractions.com/In PDF document text
- http://www.visualfractions.com/Games.htmIn PDF document text
- http://www.cooks.com/rec/convert/In PDF document text
- http://www.sheldonbrown.com/tire-sizing.htmlIn PDF document text
- http://www.primarygames.com/fractions/question1.htmIn PDF document text
- http://www.sheppardsoftware.com/math.htmIn PDF document text
- http://calculationnation.nctm.org/In PDF document text
- https://view.officeapps.live.com/op/view.aspx?src=http%3A%2F%2Fwww.elainefitzgerald.com%2Fjeopardyfractions.pptIn PDF document text
- https://en.wikipedia.org/wiki/PrevalenceIn PDF document text
- https://www.buzzfeed.com/searchIn PDF document text
- https://en.wikipedia.org/wiki/DecimalIn PDF document text
- http://www.maths.surrey.ac.uk/hosted-sites/R.Knott/Fibonacci/cfINTRO.htmlIn PDF document text
- http://www.bbc.co.uk/bitesize/ks2/maths/number/In PDF document text
- http://www.dailymail.co.uk/sciencetech/article-3211347/The-cheap-robotic-hand-set-revolutionise-prosthetics-3D-printed-device-performs-advanced-tasks-fraction-cost.htmlIn PDF document text
- https://www.nctm.org/standards/In PDF document text
- https://www.washingtonpost.com/news/the-fix/wp/2018/04/26/trumps-unwieldy-fox-and-friends-interview-annotated/In PDF document text
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
- https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004945.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4945 | 9896 bytes |
SHA-256: b84da45d69fe4c9cbc948e2e873f46f124f650f745e8fcf18a6c34cd8646ad9d |
|||
font_01_sfnt_off000068e3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x68E3 | 6668 bytes |
SHA-256: 4784276664b4b0636f8bfdfa3f1c9e4ea4bd055ca2179de032f9e901217821e7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.