MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gettraff.ru/strik?keyword=guilty+gear+rev+2+tier+list In PDF document text
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/digokasawuj-jipamuputevuf.pdfIn PDF document text
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/nojof.pdfIn PDF document text
- https://vewutaniwem.weebly.com/uploads/1/3/0/8/130873717/5204971.pdfIn PDF document text
- https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/wikuwiwa.pdfIn PDF document text
- https://kuwofepex.weebly.com/uploads/1/3/2/7/132740654/riben_gudodow.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369762/normal_5f89376a790e2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f872703153a4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365551/normal_5f889c4cacb43.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379848/normal_5f8b18b955fbc.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/1896/4122/files/19319930602.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0485/2200/2587/files/qlikview_your_business.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/2735/8115/files/18040297736.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/3362/3708/files/1478618831.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/5916/2521/files/13562206117.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/6428/2267/files/wezejagekaputajigekew.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6153/3089/files/zilesivigeremove.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0458/6438/6713/files/mifixebazuzabuvinefulod.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6815/2216/files/osrs_100_kudos_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5519619-2de8-432a-bbfb-073a3f0417be/23853741161.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e82fb79-e8e6-40bc-b7dc-a64f451193da/65382297678.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f49d6d83-2727-4aef-a502-55009bdd9592/1395598695.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97fa9889-3a37-4d41-a8fc-d67711c2760a/19418195910.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de60f5e1-d0bd-44d4-8b0a-6f41b4f4ce98/vesobukizelikatinogavafar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6da705d7-9ea5-45b5-b9a6-6c1de26ebd18/dulinikupimalinonipalu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8c02869-8f94-4902-a790-7879da9bf182/joxibamu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ff2d585-a606-4c01-9f3e-e6a690aedd24/28233651633.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007520.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7520 | 5180 bytes |
SHA-256: c0c45d78bf4ec38cd582d95558b2ceeedc4ec7aaaac9cdf1220293bfef73eba5 |
|||
font_01_sfnt_off000086e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86E1 | 9748 bytes |
SHA-256: 62e4b479fa51e586577f73a24462aaecca50a8a643c5ca556ab461e44dd70fdf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.