MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/123?keyword=ocala+national+forest+map+pdf In PDF document text
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/9051060.pdfIn PDF document text
- https://site-1039419.mozfiles.com/files/1039419/93198559412.pdfIn PDF document text
- https://site-1041926.mozfiles.com/files/1041926/71809876633.pdfIn PDF document text
- https://site-1036695.mozfiles.com/files/1036695/74395524580.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/4a2ce154-ce65-486a-80df-3c82f9f905e0/33229032460.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b6b8643-9f54-4853-909a-f036bc90c605/60713650329.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb4ca395-6fc0-4189-b07a-24d46fd622eb/rezavobama.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0811b1f8-f137-42d2-b4e7-ec25183ce115/37005069960.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e265f66a-2165-4112-bbff-827feead3eb3/5422716846.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e25662f-aed2-44ee-92dc-215094f72834/26976353540.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1289e90-63ae-4389-bdc1-1beb87a14dc9/nedevoninuviwuvikiz.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/8262/6710/files/dekinirapagobagekokofor.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6766/0706/files/work_done_calculation_worksheet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/9763/7535/files/ff14_zurvan_guide_normal.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/7207/5414/files/dotedazakixarevefom.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/1518/4295/files/72760584840.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/1080/4890/files/layers_of_the_sky_stratosphere.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0476/7426/1670/files/11206474148.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/9820/1502/files/defender_of_varrock_tracks.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0498/7217/5259/files/rhyme_scheme_worksheet_8th_grade.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007e72.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7E72 | 5116 bytes |
SHA-256: ce3e784062e2133a2dd123eb37c0ccbd6820108a6181f14531981ae5125092ec |
|||
font_01_sfnt_off00008fb4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8FB4 | 10184 bytes |
SHA-256: 2fcda5d91d72defec8db5af1f8681bb0ce852617012ecd3f8255342692c62953 |
|||
font_02_sfnt_off0000b297.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB297 | 4324 bytes |
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.