Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=solutions-manual-for-digital-systems-principles-and.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=solutions-manual-for-digital-systems-principles-and.pdfIn PDF document text
  • http://www.testbank.org/solutionsmanual.htmlIn PDF document text
  • http://www.dac.co.za/In PDF document text
  • http://www.wowebook.org/In PDF document text
  • http://blog.appliedsystems.com/In PDF document text
  • https://www.instituteforapprenticeships.org/apprenticeship-standards/digital-and-technology-solution-specialist-degree/In PDF document text
  • https://www.cadpro.co.nz/In PDF document text
  • http://www.textbookmedia.com/pr/Principles-of-Economics/4693/9780996996310In PDF document text
  • http://www.dreamsmediasolutions.com/In PDF document text
  • http://www.marleypipesystems.co.za/images/pdfdownloads/productbrochures/hdpe-buttwelding-brochure.pdfIn PDF document text
  • http://www.bender.org/solutions/gfci.aspxIn PDF document text
  • https://playbook.cio.gov/In PDF document text
  • http://kinchipsystems.co/In PDF document text
  • http://www.ecompetences.eu/In PDF document text
  • https://less.works/less/principles/systems-thinking.htmlIn PDF document text
  • http://www.hindustanautomation.in/In PDF document text
  • http://www.dcs.co.uk/In PDF document text
  • http://www.nationalccrs.org/organizations/nocti-and-nocti-businessIn PDF document text
  • http://scatterbrain.network/In PDF document text
  • https://r-stahl.com/en/global/home/In PDF document text
  • http://hvac-talk.com/vbb/showthread.php?1904111-Need-Alerton-VLD-362-manual-and-a-few-questions-about-it-answeredIn PDF document text
  • http://uncpbisdegree.com/1/signing-naturally-student-workbook-units-1-6.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-boy-who-cried-wolf-aesops-fables.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-heretics-treasure-ben-hope-book-4.pdfIn PDF document text
  • http://riverside-resort.net/1/unimelb-phd-application.pdfIn PDF document text
  • http://uncpbisdegree.com/1/solution-manual-to-calculus-tom-m-apostol.pdfIn PDF document text
  • http://uncpbisdegree.com/1/studies-in-american-political-development-vol-11-part-1.pdfIn PDF document text
  • http://uncpbisdegree.com/1/solutions-electronics-nj.pdfIn PDF document text
  • http://riverside-resort.net/1/what-is-energy-in-science.pdfIn PDF document text
  • http://uncpbisdegree.com/1/service-manual-for-2018-sonic.pdfIn PDF document text
  • http://uncpbisdegree.com/1/the-history-of-marshall-field-and-company-1852-1906.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://nam.edu/care-centered-clinical-documentation-digital-environment-solutions-alleviate-burnout/In PDF document text
  • https://nam.edu/category/perspectives/In PDF document text
  • https://nam.edu/category/perspectives/discussion-paper/In PDF document text
  • https://en.wikipedia.org/wiki/ComputerIn PDF document text
  • https://www.broadcom.com/In PDF document text
  • https://www.theengineer.co.uk/civil-engineering-digital-solutions/In PDF document text
  • http://ce.unm.edu/professional/digital-arts/In PDF document text
  • https://www.mheducation.com/highered/category.10007.htmlIn PDF document text
  • http://www.ucsd.edu/catalog/courses/ECE.htmlIn PDF document text
  • https://www.microsoft.com/en-us/design/inclusiveIn PDF document text
  • https://acrobat.adobe.com/us/en/acrobat.htmlIn PDF document text
  • https://pt.wikipedia.org/wiki/Livro_digitalIn PDF document text
  • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=PT_EN&a=https%3a%2f%2fpt.wikipedia.org%2fwiki%2fLivro_digitalIn PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text

  +3 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.