MALICIOUS
184
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gettraff.ru/123?keyword=tecno+android+phone+2020 In PDF document text
- https://mufalugibesenu.weebly.com/uploads/1/3/1/4/131453255/boxatipuredamu.pdfIn PDF document text
- https://nitiruminaxodax.weebly.com/uploads/1/3/0/7/130738633/57718d2c.pdfIn PDF document text
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/tatusomigafoj.pdfIn PDF document text
- https://redunexodozik.weebly.com/uploads/1/3/0/8/130814050/d6e676601fff782.pdfIn PDF document text
- https://tuxitusonodedin.weebly.com/uploads/1/3/0/8/130873989/nelanibopomen-jinojunuwov-xuxeba.pdfIn PDF document text
- https://wojeribexojuxu.weebly.com/uploads/1/3/1/8/131856158/1bc05797cff2.pdfIn PDF document text
- https://zozilevijuni.weebly.com/uploads/1/3/1/3/131383476/3590740.pdfIn PDF document text
- https://kagilovudugavap.weebly.com/uploads/1/3/1/1/131164538/kewivijexuxowisaji.pdfIn PDF document text
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/9537109.pdfIn PDF document text
- https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/1995488.pdfIn PDF document text
- https://ziripovopibew.weebly.com/uploads/1/3/0/8/130874468/motaxi.pdfIn PDF document text
- https://gaxopekel.weebly.com/uploads/1/3/0/9/130969853/nisivum.pdfIn PDF document text
- https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/3551090.pdfIn PDF document text
- https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/312cc18d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/355b74c9-abfa-41d6-b131-e2f187007a83/41858554335.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/65b87037-ee0d-42f9-a316-4dcc410de1c2/47795329560.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75a24439-ad4e-41ce-b452-a2bfe52a396a/31009119811.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cda00037-576a-4e50-bc6a-221b34ed444b/tepudeviwiduvupedawizelus.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a887ef30-5730-4e60-aa16-33a41b17a6f6/jukebagagexitelifotu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cccddc76-2ce1-4bd9-9b4e-998711159fb3/xigufabulumevabutivegopo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/0392/6939/files/skriv_en_kommentar_til_en_klumme.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/2573/4552/files/37341344650.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/7968/7587/files/95_jeep_cherokee_radio_wiring_diagram.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/5417/7185/files/poruwatubevakedinoxipefew.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0493/1649/5526/files/trail_rite_boat_trailers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007d99.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7D99 | 5176 bytes |
SHA-256: 7addef4c3579775e0ea8d7dcc5775e815795f1be42490f91aa29dd087227288b |
|||
font_01_sfnt_off00008f23.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8F23 | 11168 bytes |
SHA-256: db377813a35ab01b57396bdfe99594adf9bb999248bdac5c0e5da207403fcf07 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.