CLEAN
24
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0337
Heuristics 3
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.laureati.cz/perhapsorganize/kPik_s_YfGtnftkGsdr16365030lrmQ.pdf PDF link annotation
- http://www.alistatrans.ru/bbs/fmeJJewhhzmkfmaiihkmf__i16364059l.pdfIn PDF document text
- http://79.172.211.32/mail/JbtQiacoY16357672rn.pdfPDF link annotation
- http://79.172.211.32/mail/wchavaGGGoivfrkaszhxorJPwe16357710ud.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/rJxt_okvPeflvJonsze16349541eJle.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/otacaY16354852twlk.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/JPodvPho_skQQvnwiaJJzcklewsits16366818Y.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/evs_PsvldJbxo16364008mG.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/bxnfQ16358300J.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/xhYbaQzdxrPirseroPk16349377i.pdfIn PDF document text
- http://79.172.211.32/mail/_Pm16357771bJa.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/_Gbwdlm_wz16349802zli.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/ldxallxz_astmdtJvw16349874bsk.pdfIn PDF document text
- http://79.172.211.32/mail/hl_ulik_Gu_okmP_dzaYP16357850ldf.pdfIn PDF document text
- http://79.172.211.32/mail/wrtod_azwQsdohlmhYGleufxrx16357637o.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/ePfoPkuzkduPnQrznacYuhnwwcv_z16364046nst.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/hhJPcralamxJkcsesnvvGzuhPbbt16350162_ke.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/nt_kobludiQr_wtYvszhkahxb16365151mYh.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/GQz16358882zJG.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/bbkzockwrbzQuiGvPtxecYaQuGmsG16366858bbQo.pdfIn PDF document text
- http://79.172.211.32/mail/ihucQusizl_JPtfl16366364ltdv.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/acixQJltkGiYxvhk16354714Y.pdfIn PDF document text
- http://79.172.211.32/mail/twmGJYxtwmYbJv16357381mz_.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/ihnllnPaet16365233xnPx.pdfIn PDF document text
- http://79.172.211.32/mail/Pdfsb_QekJbP16366385a.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/omPxkrmmtkdYviv_wx16349397dk.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/lmabmPJrY16363989zQY.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/rbYrurb16349766abe.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/ne_drddi16358547nmP.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/a_dub_m_cJwwcJePnaan16354506iYn.pdfIn PDF document text
- http://www.masterdea.it/bbs/PofmeaunvwoJGvhftws15188087wvi.pdfIn PDF document text
- http://www.masterdea.it/mobile/ihceks__cQYnxJfJhwPJrfcG15321098vP.pdfIn PDF document text
- http://www.zerodeuxsix.com/nrnaGlnYwlokzeximGh4585702.pdfIn PDF document text
- http://www.corsoanatocismousura.it/index.php/docs/JrcsaufxiQQl_cYuvnoc15417188en.pdfIn PDF document text
- http://www.masterdea.it/treatment/odcch15135044bQt.pdfIn PDF document text
- http://79.172.211.32/mail/dtfnsa16357280eJ.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/ruGxiunlQYmizlGuthwxnvG16363941v.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/JttPrftsev16358519vtY.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/GhnYfQuhuriYi16349559b.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/GovtGctfoYPYtvitwklxxaJnhs16349589izfn.pdfIn PDF document text
- http://www.laureati.cz/perhapsorganize/fzmxhubJxltolalGtQGeJz16366976rct.pdfIn PDF document text
- http://79.172.211.32/mail/Josb16357991axQ.pdfIn PDF document text
- http://79.172.211.32/mail/ivxnmkwlbvlx16358064JQet.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/axJkQhwtlxfPQfYJwGnPsecu16354928iv.pdfIn PDF document text
- http://thestoveinstallationcompany.co.uk/historydepartment/dmrlxnQJ16349549vGsi.pdfIn PDF document text
- http://79.172.211.32/mail/irxn16358119_mG.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/umeouvhswkdov16354467tQYQ.pdfIn PDF document text
- http://79.172.211.32/mail/kotdhviwPbhve_zJcrikrl16357530cxQ.pdfIn PDF document text
- http://www.alistatrans.ru/bbs/vumsPewlschuitb16363852Ja.pdfIn PDF document text
- http://79.172.211.32/mail/needmJibk16357209J.pdfIn PDF document text
+22 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off00009e61.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x9E61 | 19856 bytes |
SHA-256: a930245e90be17a336a7679d31e9d416ddec66c65020bec75b59b2e2bfc19120 |
|||
font_01_sfnt_off0000d3f3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD3F3 | 19964 bytes |
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8 |
|||
font_02_sfnt_off000109b0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109B0 | 20828 bytes |
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.