CLEAN
22
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0405
Heuristics 2
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://79.172.211.32/mail/_krknPueQbam16357861nkle.pdf PDF link annotation
- http://www.laureati.cz/perhapsorganize/tzrkQsneffxlnwJoim16365052dka.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/_aGcxGPJJbdiv_Jb16354458o.pdfIn PDF document text
- http://79.172.211.32/mail/vrf16357651fo_.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/cPnhkfuimlmhumYxbdazGtsu_l16354497Ga.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/vsclmzhu_P16365078mi.pdfIn PDF document text
- http://79.172.211.32/mail/Gutluwe16357703f.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/iahtx_ioinzhxiYh16366812e_ox.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/nrdm_voYllstszueJrsirae16358820vGuQ.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/xYnnxzJG_bswonmntdbs_oadbhhmis16355009kd.pdfIn PDF document text
- http://79.172.211.32/mail/zxPwx16366382iY.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/hzJnrssxixrmxPnecYuikJfJ16354995J_i.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/bmrorPstmeiirfranndo16358461vs.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/izebkooQszQwuuokshv16350154wa.pdfIn PDF document text
- http://79.172.211.32/mail/nfsotfudcJhzP16357482wzn.pdfIn PDF document text
- http://79.172.211.32/mail/Gflnfefldrt_vh_flrw_Qrfin16358168kJzc.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/esxwiinxkadt16350006_xvf.pdfIn PDF document text
- http://79.172.211.32/mail/imednxeJGQwiwPr16358094Q_Qm.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/QihYofb16358721Y.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/kdshPsidYubhtdrlueckroYef16366994P.pdfIn PDF document text
- http://79.172.211.32/mail/raPvu_n16358084Y.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/d_hkww_G_Jtxo16349367n.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/zvoxuuarnb16350057uG.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/Qfmecw16358512bxw.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/PecoaaYoirbwfzbumwa_sxm16358830bx.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/_fszJwxdJYPYlsQreG16366915rsm.pdfIn PDF document text
- http://79.172.211.32/mail/JuzGotuYtPYtcchatxGszkxemtbPr16357291hrrQ.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/J_eYwa__uaekG16358947iPms.pdfIn PDF document text
- http://79.172.211.32/mail/tvzuitJiwfcsi16366264Yxd.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/JPwukvkdxb_bcwdsmYvxkG16366823hJ.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/uuYP_fnti_trazPstzPnimYGzib16349728cmke.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/fl_rJYnuazboxkv16366897mamz.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/zdJmc_aebPwGwxdwm16350120awa.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/dbQvvwYeszznxJYYaPhYfmbkffuvaz16364065m.pdfIn PDF document text
- http://www.masterdea.it/bbs/kxxluPdwonnvvf15131121acGi.pdfIn PDF document text
- http://store.creative-dots.com/documents/YdJdw16231097JPd.pdfIn PDF document text
- http://blog.creative-dots.com/notification/Qivd16262902thd.pdfIn PDF document text
- http://www.masterdea.it/mobile/dnoJPaQdifnJczQveuJd15348656lYik.pdfIn PDF document text
- http://www.masterdea.it/mobile/QlcutGtrtm_QuQ_abJY15311542Qka.pdfIn PDF document text
- http://79.172.211.32/mail/az_mmvPhkisrulhx16366240G.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/rP_edumdhcdzQsoxvinPiJvbc__16349432lcr.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/mPhcznsaulsmttizxadzlcih16354746e.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/vPGJxofaifmemx16358363_.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/nebercYknvzrGmcea__d_16349845zJJ.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/Gwrwbaesdb16349635kraP.pdfIn PDF document text
- http://79.172.211.32/mail/vdrsviadQwGiutGaociJt16357805Qa.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/ltanwsfhnJa_wfe_ePYa_Yzn16354516f.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/bavQmdPweorf16354205YJ.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/Gmeln16366797uxcG.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/isQPnkzxrnu16355003r.pdfIn PDF document text
+27 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off0000a593.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA593 | 19904 bytes |
SHA-256: 02df1dbb5fd37065ffce0d7ec498fded54fecc59c4d54748f3cfe34f0843886c |
|||
font_01_sfnt_off0000db1f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB1F | 19964 bytes |
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8 |
|||
font_02_sfnt_off000110e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x110E4 | 20828 bytes |
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.