Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=the-teacher-who-forgot-too-much.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=the-teacher-who-forgot-too-much.pdfIn PDF document text
  • http://www.pickupartistmindset.com/flirting/how-to-flirt-with-your-teacher/In PDF document text
  • http://www.craftaholicsanonymous.net/12-reasons-your-wife-spends-too-much-at-hobby-lobbyIn PDF document text
  • http://www.michaelcorcoran.net/archives/1469In PDF document text
  • https://www.triedandtrueblog.com/teacher-survival-kit/In PDF document text
  • http://www.teachwombat.com/In PDF document text
  • http://teacherhabits.com/why-teachers-are-so-tired-and-what-to-do-about-it/In PDF document text
  • http://riverside-resort.net/1/when-insurers-go-bust-an-economic-analysis-of-the-role-and-design-of-prudential-regulation.pdfIn PDF document text
  • http://uncpbisdegree.com/1/storytown-schools-around-the-world-comprehension-test.pdfIn PDF document text
  • http://riverside-resort.net/1/universe-a-journey-to-the-edge-of-the-cosmos.pdfIn PDF document text
  • http://uncpbisdegree.com/1/tec-fs-2600user-manual.pdfIn PDF document text
  • http://uncpbisdegree.com/1/smc-ez-switches-owners-manual.pdfIn PDF document text
  • http://uncpbisdegree.com/1/solutions-test-answers-sheet.pdfIn PDF document text
  • http://uncpbisdegree.com/1/suzuki-r150-parts-catalog.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-gold-cadillac.pdfIn PDF document text
  • http://riverside-resort.net/1/what-is-considered-dramatic-weight-loss.pdfIn PDF document text
  • http://uncpbisdegree.com/1/seiko-suj797-watches-owners-manual.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://slatestarcodex.com/2016/05/19/teachers-much-more-than-you-wanted-to-know/In PDF document text
  • https://www.education.com/magazine/article/Ed_Academic_Preschools/In PDF document text
  • https://www.education.com/articles/Academic+Preschools%3A+Too+Much+Too+Soon%3F/In PDF document text
  • https://www.redtube.com/58038In PDF document text
  • http://tvtropes.org/pmwiki/pmwiki.php/Main/TooMuchInformationIn PDF document text
  • http://tvtropes.org/pmwiki/pmwiki.php/Main/MySpeciesDothProtestTooMuchIn PDF document text
  • https://www.livestrong.com/article/280411-how-to-remove-too-much-salt-from-soup/In PDF document text
  • https://www.livestrong.com/scat/diet-and-nutrition/In PDF document text
  • https://www.livestrong.com/sscat/protein/In PDF document text
  • https://www.livestrong.com/article/529555-what-are-the-effects-of-too-much-spinach/In PDF document text
  • https://www.livestrong.com/sscat/nutrition-facts/In PDF document text
  • https://www.pbslearningmedia.org/In PDF document text
  • https://www.mindbodygreen.com/trainings/meditation-teacher-trainingIn PDF document text
  • https://au.ixl.com/signin/tyndaleIn PDF document text
  • https://www.literotica.com/s/pet-teacher-3In PDF document text
  • https://www.literotica.com/c/lesbian-sex-storiesIn PDF document text
  • https://xhamster.com/videos/hot-futanari-teacher-surprises-students-6430806In PDF document text
  • http://www.bbc.co.uk/worldservice/learningenglish/language/theteacher/2009/03/090311_teacher_animal_dog.shtmlIn PDF document text
  • https://www.pornhub.com/view_video.php?viewkey=ph5a0daf3c370f6In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.