MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file contains embedded URLs that point to a domain associated with malicious downloads. The ML classifier also flagged this PDF as malicious with a high probability. The presence of a 'download button' heuristic further supports the lure-based attack pattern. The primary intent appears to be tricking the user into downloading a secondary malicious file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9202
Heuristics 4
-
Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOADThe ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
-
PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARMPDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=selected-poems-and-four-plays-wb-yeats.pdf In PDF document text
- http://uncpbisdegree.com/download4.php?q=selected-poems-and-four-plays-wb-yeats.pdfIn PDF document text
- http://www.sfheart.com/ArtPoetryEvents.htmlIn PDF document text
- http://www.michaelrosen.co.uk/for-adults-news/In PDF document text
- http://www.victoriasway.eu/In PDF document text
- https://essayerudite.com/In PDF document text
- http://hamburggermany.men/Jaboatao_Dos_Guarapes-Brazil/Jaboatao_Dos_Guarapes-Brazil_bb.phpIn PDF document text
- http://riverside-resort.net/1/teacher-guide-cracking-the-periodic-table-code.pdfIn PDF document text
- http://riverside-resort.net/1/the-sun-is-my-favorite-star.pdfIn PDF document text
- http://riverside-resort.net/1/sophocles-antigone-a-new-translation.pdfIn PDF document text
- http://riverside-resort.net/1/tristan-shandy-life-and-options-of-a-gentlemen.pdfIn PDF document text
- http://riverside-resort.net/1/the-march-of-patriots-the-struggle-for-modern-australia.pdfIn PDF document text
- http://riverside-resort.net/1/the-borrowers-afield-2-mary-norton.pdfIn PDF document text
- http://riverside-resort.net/1/troubleshooting-guidelines-manual.pdfIn PDF document text
- http://riverside-resort.net/1/trx-suspension-training-course-manual.pdfIn PDF document text
- http://riverside-resort.net/1/toyota-prius-haynes-repair-manual-torrent.pdfIn PDF document text
- http://riverside-resort.net/1/skoda-octavia-fuse-box-wiring-diagrams-and-wiring.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://en.wikipedia.org/wiki/W_B_YeatsIn PDF document text
- https://en.wikipedia.org/wiki/PoetryIn PDF document text
- http://catalog.unc.edu/undergraduate/departments/english-comparative-literature/In PDF document text
- https://www.bbc.co.uk/programmes/b05sxv7bIn PDF document text
- http://advanced.jhu.edu/academics/graduate-degree-programs/liberal-arts/course-descriptions/In PDF document text
- http://www.openculture.com/freeaudiobooksIn PDF document text
- http://www.loot.co.za/index/html/index2410.htmlIn PDF document text
- http://www.dailymail.co.uk/news/article-1315781/Wilfred-Owens-anti-war-poem-Dulce-et-Decorum-Est-David-Cameron-favourite.htmlIn PDF document text
- http://www.loot.co.za/index/html/index1423.htmlIn PDF document text
- https://it.wikipedia.org/wiki/LibroIn PDF document text
- http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=IT_EN&a=https%3a%2f%2fit.wikipedia.org%2fwiki%2fLibroIn PDF document text
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
- https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
- http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000430b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x430B | 9688 bytes |
SHA-256: da0bc7b517901b283152a5d6fc6482102e051ba3e7759c39b5ebd17a717cbc3b |
|||
font_01_sfnt_off00006208.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6208 | 7116 bytes |
SHA-256: 032ea35e30bec0a2a6786c0f0843ebd142b7418f75ca67ffe0803af5b6f96674 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.