MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/aws?keyword=tithi+toran+gujarati+calendar+2016+pdf+free+download In PDF document text
- https://cdn-cms.f-static.net/uploads/4375095/normal_5f8a2ae13de57.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408594/normal_5f9245d89ff80.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383794/normal_5f8c8e20ed842.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376606/normal_5f8cee7aabbe2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373985/normal_5f906c8fd94e4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/058054e7-2de5-48cd-b6da-6911af5dcaf0/80563505409.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c86ee5a6-a00e-40d6-b1bc-74e2318773d4/76839378474.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db19d226-9230-4858-b63a-a632325de340/sijawisavepafogix.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/4373/9560/files/historia_del_tahuantinsuyo_maria_rostworowski.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/2417/7093/files/word_e_evirme_program.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/1788/5598/files/active_and_passive_voice_interrogative_sentences.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8675/0916/files/python_for_dummies_book.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0494/0031/6060/files/android_studio_error_gradle_project_sync_failed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d98586b0-fef9-40da-bb9f-d1952366af87/72874277186.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb0f4400-c394-464e-bc2a-2687422ac534/33571397457.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bcfde70d-ea06-4012-8c00-640669afbd55/fight_autism_and_win.pdfIn PDF document text
- https://s3.amazonaws.com/sugaguxagu/27429117801.pdfIn PDF document text
- https://s3.amazonaws.com/neviwove/acids_bases_and_salts_test.pdfIn PDF document text
- https://s3.amazonaws.com/kavitokolezub/butler_s_lives_of_the_saints.pdfIn PDF document text
- https://s3.amazonaws.com/pazifetanegapu/92906265493.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6099303-a045-45b4-b78b-b62267b22a01/13603829479.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28c378e1-c13e-4945-a638-55b4c43a03b3/jatitewipusunodotelumuka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50342610-3326-4206-9702-938cde9001a5/bufejebepibixusoxigilim.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d946ba60-f6b1-4650-8cca-b9a7293e7e2a/citizens_spigot_1.8_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006a66.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A66 | 5836 bytes |
SHA-256: 1cfe915010615525355ca97e9fa9f773ea7642a062ef207f408f8c97ef0481c0 |
|||
font_01_sfnt_off00007e56.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7E56 | 10932 bytes |
SHA-256: b366358eacb6f736ce209625a4c44eef82155c01bdd8bb78770c15c6d95e70a1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.