MALICIOUS
184
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gettraff.ru/strik?keyword=pmp+edition+5+pdf+free+download In PDF document text
- https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/katilus-kolitumupogi-junipoxovak-zotesu.pdfIn PDF document text
- https://zelapagetuwuj.weebly.com/uploads/1/3/1/4/131406140/xipawu-temubel-kobasugexi-xobizipaw.pdfIn PDF document text
- https://lasajiboz.weebly.com/uploads/1/3/1/3/131379041/vutelomete.pdfIn PDF document text
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/zirilapalir-bisojexowesomes.pdfIn PDF document text
- https://sokuvotaboraj.weebly.com/uploads/1/3/0/7/130776263/xuzutadaxaw_rusorit_pemowod_litokizuv.pdfIn PDF document text
- https://melegejisud.weebly.com/uploads/1/3/1/3/131379421/34938d4b6eaa9.pdfIn PDF document text
- https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/aebca45c.pdfIn PDF document text
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/movew.pdfIn PDF document text
- http://www.opentle.orgIn extracted file (stream_005_off0000a1b8.bin)
- http://www.ascendercorp.com/In extracted file (font_01_sfnt_off00008ffd.bin)
- http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_01_sfnt_off00008ffd.bin)
- https://uploads.strikinglycdn.com/files/fce56cb0-ac10-4e0b-b7ee-0845e142e553/gepupaxes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f8fc281-3cce-4ffb-bda1-f33283a56d34/towipelesiwetexirotefuba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/677b6943-ba7c-431f-b42c-03c9f817aab8/ridolaxunafuwusukepe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c96fbad-4839-4bc9-bfc2-64912789d6ad/62375209558.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16229ce0-95ff-432d-9e75-1b35fc4d7e9e/sonigogadafanaxojagag.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/5752/0026/files/learning_from_landmarks_crossword_answers.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/4891/4081/files/farragut_high_school_football.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0502/5307/0509/files/drayton_digistat_scr_wireless_receiver_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91a5e8b2-4de2-4297-af34-c71370153738/funomefuboj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9280e7aa-8c92-4cb0-abf9-83e93116e751/mexebasikabulavugukani.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn extracted file (stream_005_off0000a1b8.bin)
- http://scripts.sil.org/OFLIn extracted file (font_01_sfnt_off00008ffd.bin)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off0000a1b8.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA1B8 | 12612 bytes |
SHA-256: da8df3da322e129f276e65d5411cdbc35650189666b94674ce2f00fc55dbd21b |
|||
font_00_sfnt_off000068ab.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x68AB | 12000 bytes |
SHA-256: 5b5f3ffd1aa5c0827bd6ee449cb98298c1e57cfd1d7471c7ee87a4888a2fff90 |
|||
font_01_sfnt_off00008ffd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8FFD | 5224 bytes |
SHA-256: ea21e3ad044f3eadcb4db2842a9d3984c08ac5defedc41839a05841f2dff65ef |
|||
font_03_sfnt_off0000c54c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC54C | 9912 bytes |
SHA-256: 5b08b648fec890708f8841c3c20e5b51f96c51b2fc45df384bd48e5843de6ec3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.