CLEAN
24
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0337
Heuristics 3
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://thestoveinstallationcompany.co.uk/historydepartment/ssbzQidlJfkYwwPdz16349775vbaY.pdf PDF link annotation
- http://79.172.211.32/mail/_io16357400_z.pdfPDF link annotation
- http://thestoveinstallationcompany.co.uk/historydepartment/abn16349511GzzQ.pdfIn PDF document text
- http://79.172.211.32/mail/cQclP_ivsbzcwal_fkdwmrfuJz16357499Jo_c.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/zQmnJltonPtmaflifvkotod16354575Ja.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/ueaGx_cci_cxwrkr16350164wivz.pdfIn PDF document text
- http://79.172.211.32/mail/brQxkhnoJrhk16357295de.pdfIn PDF document text
- http://79.172.211.32/mail/raeck_YzwY16366191utzk.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/vnJrsvbYcvmcn16354230x.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/aYzxskQeYdtGGPPfoictk16358314hG_h.pdfIn PDF document text
- http://79.172.211.32/mail/oJQzx16357721tls.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/mJJt16358823sx.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/bdrfPQcafzdmndrrGloJwQnee16354553v.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/rvshwQbumw_xzuQzwiffmoan16350148Qv.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/vhQJtw16359001vn.pdfIn PDF document text
- http://79.172.211.32/mail/QQYQdGcmlQcfvsxshcoexd16357862b.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/fnYfnJnascuG16358748l.pdfIn PDF document text
- http://79.172.211.32/mail/etG16357193bPo.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/emxekJ16358523k.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/_svP_urtxrlrGPJiholf16354200uf_Y.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/vkGGiih_QdhJssfveP16365207oc.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/cc_16350104Qtm.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/_iPzG16366896bJfJ.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/_hmoaftausQPeubsuwJQGfurQb16350127f.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/cfufxGPzrwzfcoexinlwned16354272ldw.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/iezzibmxohokkkddGtxYbfrrr16354600Qk.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/rdJvetwhdacx16358645k_d.pdfIn PDF document text
- http://79.172.211.32/mail/xuveQhJ16357841mm.pdfIn PDF document text
- http://79.172.211.32/mail/wYtkhvisikx16357779lw.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/aiJhc16367045cou.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/ofzJhrmetvJzfedhirnJncePY16349410aow.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/fnm_QribkcaxaQtdfeQtJnviwi16363928bi.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/aibwhivtPtdh__sca_nPhrr16354728Pw.pdfIn PDF document text
- http://www.masterdea.it/mobile/nmcQosxaitxcdaotGexzYfGhuJnGYQ15526641r.pdfIn PDF document text
- http://new.k-trhy.cz/ektJJ5300276vc.pdfIn PDF document text
- http://www.masterdea.it/mobile/wGYlerGudsfx_zfvPQstsrJ15198201lb_v.pdfIn PDF document text
- http://www.masterdea.it/treatment/PwhkzsGPxbcarwGxtrof_iifhfait15134829u.pdfIn PDF document text
- http://www.masterdea.it/mobile/axGxntPQtudmfb_Pom15440601kvki.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/elQdiukzlhamincnaaefbxb16350159lrmP.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/zfha16349964l.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/htsQlrfsPGkQhYah16359065neJ.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/xGbrtikabm16354191xv.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/ohkYuacineuxJbeoJsarrf16349980wua.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/deJoGtbPdskthoeY_16354627_sk.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/nlwaattG_PetlPvcwuhhuboJimP_i16349667mrr.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/rzlYfQvhonPzrki16358724unn.pdfIn PDF document text
- http://79.172.211.32/mail/nzGoPxzncou_kckhlbQud16366323rrth.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/bk_hJlahlicQQv_Qwd_cdhY_YYwob16358449f.pdfIn PDF document text
- http://79.172.211.32/mail/ieurQrfzYowGnmzufzon_am16357200i.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/t_zrmevtPluft16349712GrYf.pdfIn PDF document text
+26 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off0000a422.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA422 | 19944 bytes |
SHA-256: be3248d986559ab8601bf8e33f85a811d5cb00e1700190c05cb2415cfd90fbe0 |
|||
font_01_sfnt_off0000da00.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA00 | 19964 bytes |
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8 |
|||
font_02_sfnt_off00010fc3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FC3 | 20828 bytes |
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.