Malicious PDF — malware analysis report

Heuristics 4

• Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
  The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
• PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
  PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://uncpbisdegree.com/download3.php?q=suzuki-dt-225-outboard.pdf In PDF document text

  • http://uncpbisdegree.com/download4.php?q=suzuki-dt-225-outboard.pdfIn PDF document text
  • http://www.dlfiles24.com/pdf16/139676882-suzuki_dt_outboard_workshop_repair_manual.pdfIn PDF document text
  • http://www.instant-manual.com/1988-2009_Suzuki_Outboard_Engine_Service_Manuals.htmlIn PDF document text
  • http://www.spxprecision.com/suzuki-1994-40-hp-outboard-service-manual.pdfIn PDF document text
  • http://www.brownspoint.com/In PDF document text
  • http://www.brownspoint.com/store/pc/suzuki/df70/01.aspIn PDF document text
  • http://www.marineengine.com/boat-forum/forumdisplay.php?32-Suzuki-Outboard-ForumIn PDF document text
  • http://www.marineengine.com/boat-forum/forum.phpIn PDF document text
  • http://www.marineengine.com/boat-forum/forumdisplay.php?966-Outboard-Motors-ForumIn PDF document text
  • http://www.instant-manual.com/Download_Marine_Engine_Service_Manuals_By_Brand.htmlIn PDF document text
  • http://www.service-repair-workshop-manual.com/category/outboards/johnson-evinrude/In PDF document text
  • https://www.themanualstore.com/Suzuki-Outboard-Motor-Service-Repair-Shop-Manual-p/b778.htmIn PDF document text
  • https://www.tacklereviewer.com/freebies/outboard-engine-wiringIn PDF document text
  • http://www.abvilrealty.com/1999_suzuki_grand_vitara_service_manual.pdfIn PDF document text
  • http://www.megalawbooks.com/yamaha-150-hp-outboard-service-manual-1996.pdfIn PDF document text
  • http://www.usedjapanesebikes.com/stock-search.phpIn PDF document text
  • https://www.themanualstore.com/International-Harvester-DT239-Engine-Manuals-s/32223.htmIn PDF document text
  • http://www.theauctioneer.co.uk/saleresults.htmIn PDF document text
  • http://riverside-resort.net/1/sewing-machine-instruction-manual.pdfIn PDF document text
  • http://riverside-resort.net/1/the-townsend-college-preparatory-reading-test-form-b-answers.pdfIn PDF document text
  • http://riverside-resort.net/1/the-defiant-hero-troubleshooters-2-suzanne-brockmann.pdfIn PDF document text
  • http://riverside-resort.net/1/term-1-2018-geography-paper-grade-11.pdfIn PDF document text
  • http://riverside-resort.net/1/trace-tori-the-shadowdance-club-4-siren-publishing-classic.pdfIn PDF document text
  • http://riverside-resort.net/1/tall-dark-amp-hungry-argeneau-4-lynsay-sands.pdfIn PDF document text
  • http://riverside-resort.net/1/storytown-schools-around-the-world-study-guide.pdfIn PDF document text
  • http://riverside-resort.net/1/the-nothing-that-is-a-natural-history-of-zero-robert-m-kaplan.pdfIn PDF document text
  • http://riverside-resort.net/1/twin-headlights-for-motorcycles.pdfIn PDF document text
  • http://riverside-resort.net/1/the-associate-cet-study-guide.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://www.ebay.com/bhp/suzuki-diagnosticIn PDF document text
  • https://www.boats.net/catalog/johnsonIn PDF document text
  • https://www.boats.net/catalog/evinrude/outboard-by-year/1995In PDF document text
  • https://www.aliexpress.com/w/wholesale-yamaha-outboard-parts.htmlIn PDF document text
  • https://onslow.craigslist.org/search/bpaIn PDF document text
  • https://www.cmsnl.com/yamaha-dt400-1976-usa_model8553/partslist/In PDF document text
  • https://www.cmsnl.com/yamaha-dt50rsm-2005-2c37-austria-1d2c2-300e4_model46722/partslist/In PDF document text
  • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
  • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
  • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
  • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.