MALICIOUS
192
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 6
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/123?keyword=iphone+ringtone+download+for+android+mr+jatt In PDF document text
- https://towetebofipu.weebly.com/uploads/1/3/1/4/131437669/xakowitugiwevul.pdfIn PDF document text
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/zuvekazabuz-topofelo-gupolekodojavo-ponabiloxe.pdfIn PDF document text
- https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/parorumix-sunekinuvo-gapojam.pdfIn PDF document text
- https://genamimiwovem.weebly.com/uploads/1/3/1/6/131636881/0f09e.pdfIn PDF document text
- https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/2752886.pdfIn PDF document text
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/7904132.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/008a7d44-0cb1-4df4-96be-934919de5a53/zivexugimisisig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e57e3ef6-8933-4580-9755-1602a1026945/mezixafuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/424d7551-59f5-492b-90f2-fbb10efa1d06/12377686825.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/094baeb2-0391-4dc2-ab23-c0aec5522bf7/89293031197.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/786bd50c-7902-41bd-9f2d-4015acad9bae/gowelaju.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22870d07-b878-468f-8403-ff542ffb19d7/goxaxed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6e77f8c-b02c-44da-8aff-8ee0251e6404/68747212964.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/273db317-4f3f-4d04-bc99-6e6d455e7a63/kedopoze.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b75f4f8-bdeb-47e2-b183-d46dd21a9a73/80971311213.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77b18202-1e8b-4934-aa23-de09216716fa/8623912186.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90f7b3e2-2271-432d-a7e8-2b3647ffcd80/5000580361.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f32d5dc-b528-46af-9d6f-ad18e989b4e9/vojokubotalewinofimivajej.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01b5d939-87fc-4737-a5e1-5fe30039b247/pegum.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/7073/7563/files/84256117522.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/5083/5353/files/preliminary_phytochemical_screening_of_plant_extracts.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004fbf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4FBF | 5380 bytes |
SHA-256: e08f0beaca8d5c4691676078df8cbc27592677a77c0e8170ac854ffce10c4063 |
|||
font_01_sfnt_off000061f7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x61F7 | 9360 bytes |
SHA-256: 4693b97785705800864ed989b3102264d46b14eb7a941225e8ea71b92b3c3a65 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.