SUSPICIOUS
34
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0355
Heuristics 3
-
PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARMPDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wzuPcYuiQlxmfzmrGQfverwicxo16218111w.pdf PDF link annotation
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wu_JGt16258763rhkh.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/ll_tnvsvhva16217305te.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/rxzdozwkJmilaG_Yubkcbe16217788xk_J.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/husrbuPksGvr16217387ll.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/Jzibfwvlaobmmvl16217343Yaim.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_PQYalcPlx16217690xcY.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/ci_w_QvhQltkzmhxbweikbmhcs16258653Gdf.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/akdnQ_lzlwYlxc16217255br.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/nhQtPkwwYb16258624xdkv.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vl_nivkus_fPGJYYxuhcisxlnt16258847_.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/uJmJJ_QlGwfkberw_16258874o.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/n_mokPJrwldzbklolmhnweGutfaP16217334c__h.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/dmfesddYefhwGlnrnPrhwcdGc16258819btn.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vllQcYYQxnfz16217254o.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/dckQbxf16218030l.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/mlQeGQbJdkw16258793o.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/nmGcza_a_wxeGfob16258739rtP.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vlurtu_zawuv16217303QzJ.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/PJYmiooib16181539Jto_.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/_uaGoQYJusc_16181523a.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/_zPasisneQuYQPrxuPkfvld16186082ntm.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/ev_nkhPo_G16185809bi.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/hwvzxdPv_16202954hh.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/meGl_GsQvrbJfvvbf16199450l.pdfIn PDF document text
- http://www.partyservicedaro.nl/armboard/twYklmwteaPcrJGnnPrJhvYsoiv16203074chvY.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/JrzQauzacGrcm16202393bl.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/YwrcPchJebQbYr_czl16196437hQw.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/tJrfvG_sG_k16196583neu.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/tsfsvdwYJPzarewneYlJovudtwiY16188572k.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/u_oz_Gwwx_btftGxrxelikwGcw16202335hdG.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/virurfYbcmnrduY16256444zP.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/wtkrwoPhvJvatrrbrQukhzxedfmr16202492fk.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/wtwmtnrilvl16256393vb.pdfIn PDF document text
- http://permatatour.co.id/halfwhole/xxcnzdaY_edttahrJwY_owekrz16256220vn.pdfIn PDF document text
- http://partyservicedaro.nl/viewsure/azreuGmhzzada16255670bQ.pdfIn PDF document text
- http://partyservicedaro.nl/viewsure/cPszuJhurnhYlrxtvtbxwllce_e16177639omY.pdfIn PDF document text
- http://partyservicedaro.nl/viewsure/cxilGvYxYca16177652nmeY.pdfIn PDF document text
- http://partyservicedaro.nl/viewsure/iYdhcraoscanuxlk16188436wkP.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/site_map.xmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00006b4c.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x6B4C | 19824 bytes |
SHA-256: 1007b9c0d29cc5a5933239e4adf9ccb29bdb5162302804c4f70c80d630bfaf41 |
|||
font_01_sfnt_off0000a0c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA0C1 | 19964 bytes |
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8 |
|||
font_02_sfnt_off0000d67a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD67A | 20828 bytes |
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.