MALICIOUS
184
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gettraff.ru/123?keyword=hiragana+reading+test+pdf In PDF document text
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/kedoxezezaj-temolej-zunemalavorun-mutelokowomimi.pdfIn PDF document text
- https://pisanofinupu.weebly.com/uploads/1/3/1/4/131437881/dffab1288277a8.pdfIn PDF document text
- https://tudupumodowi.weebly.com/uploads/1/3/1/4/131406798/parogafagelujagofo.pdfIn PDF document text
- https://sixapinipuso.weebly.com/uploads/1/3/1/3/131384402/relin_rimij_xapubamalos_pebixad.pdfIn PDF document text
- https://miremewokar.weebly.com/uploads/1/3/0/7/130738658/fuwadujer.pdfIn PDF document text
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/buwomif.pdfIn PDF document text
- https://worozimovazez.weebly.com/uploads/1/3/1/4/131406108/2061882.pdfIn PDF document text
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/fajigumopomaz_sugusirigadeg.pdfIn PDF document text
- https://vodiwisilob.weebly.com/uploads/1/3/2/6/132681054/mipakowavovivajabi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366041/normal_5f88add715c1a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f8710b3acd13.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/718534f6-cb82-4efe-b976-f81ca1328714/6934205087.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9670f6c9-ec99-4588-a49c-bd2db6faea7a/55811388625.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/88c7b682-a567-421e-9840-8db7a8f7cc91/26605886342.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0879bc2d-0b85-4c45-9919-a4da2aa342e9/sorisemuwixagi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/95e4b2e8-df8b-4354-a229-b706e7500c89/italian_football_form_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e3a1cc47-d216-4fe2-a359-b3f6c4a4fbe0/74678867273.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25969d99-7edd-4b05-8e68-42836baca542/teraxeredikamogesises.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b0d0f2fe-32f3-4172-9364-e0bcb3e6d9fd/27067414414.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a3a33be7-8fc4-4665-a197-a46c9a30de65/fixanejefupikufi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000804d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x804D | 12400 bytes |
SHA-256: 30f516af8d94ef2cf698e68a35358e3bdade1d7cc31a0dbdf47a1b82080c3961 |
|||
font_01_sfnt_off0000a8fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA8FB | 5136 bytes |
SHA-256: d6b3f48384fc774a36d14a6edb0514c79f11787b1b68677456a60fb3512601d0 |
|||
font_02_sfnt_off0000ba70.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBA70 | 1800 bytes |
SHA-256: e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d |
|||
font_03_sfnt_off0000c2fe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC2FE | 10112 bytes |
SHA-256: 2486eed6c35d8d2e4f8fb5cb4e94e797a51a19874cda37c0887936aeea11da44 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.