MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/123?keyword=module+16+piston+engine+pdf In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0467/9722/6133/files/sibivobirupoko.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/1774/3767/files/rulagajekadetimilodugisoj.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/9331/0631/files/7059380717.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/2220/8152/files/ka_uluwehi_o_ke_kai.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4797156-da76-4288-b2cb-ffec6765846a/tabobow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0917a04c-e10f-4f7d-95a3-84789089fe4f/33777401141.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb4bb872-b123-4a5a-be8a-477dc651dac7/kusokonexu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51fe3f26-346e-4794-94fb-1c6e2aa97060/80913973008.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/361e3adf-5c17-4216-8f5b-7a2de12fc9bc/99877520591.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b611bf29-af2b-40bc-a2e8-daa9157684d0/939004713.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/acd697ee-a51c-451a-a1bd-65cc326730b7/6163384855.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cdb1a875-4f5b-4131-bdd9-1fe481c218ba/fukisuke.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be2916a2-a905-4e94-ba0d-f0ca485ea351/wonojurarulanu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b333194-ebc8-494f-b9e5-ccc77a6176a9/21929559712.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ebd59eff-4d4d-45b6-9473-e03621ff3def/6629997938.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42340825-7e54-446f-be27-948273e5f3ec/17944214189.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/820d4fea-f041-4dcf-b65d-014b7658510d/japugoti.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ccefafb-48f7-47fb-86d6-91ee5516dc2b/33773589106.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/323ba411-e6be-476c-a658-545336e2b3aa/49316201591.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/12086688-8ca0-4433-a10b-68d6f1d7012f/dukafevemifekag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0594748a-d65c-45a4-95f3-47f5dbb732d9/punefeli.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b0730c3-3998-4dc7-8607-1aa40bdabf35/33104770331.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ccc3321-f2ce-4110-9942-c5f6bc9bb31b/60939337295.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a292768f-9016-4cdf-a2b7-b393ddf98c0b/11448322631.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006a10.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A10 | 4996 bytes |
SHA-256: b46829bf926eb756f537bc70f1ebf99f0dc331731b83ad5e79756f2a088f8b67 |
|||
font_01_sfnt_off00007b33.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7B33 | 10208 bytes |
SHA-256: d0292cfc01b9054a2fec46c308c364d851d6c59eee100f2f4a1175a3acf3d45a |
|||
font_02_sfnt_off00009e20.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9E20 | 4324 bytes |
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.