MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/123?keyword=acknowledgement+in+report+pdf In PDF document text
- https://seririgikum.weebly.com/uploads/1/3/0/7/130739922/simanaf.pdfIn PDF document text
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/8536469.pdfIn PDF document text
- https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/a6249e7e4.pdfIn PDF document text
- https://site-1039544.mozfiles.com/files/1039544/tank_star_apk_mod_android.pdfIn PDF document text
- https://site-1040248.mozfiles.com/files/1040248/xidawegaxanowazifexeje.pdfIn PDF document text
- https://site-1043080.mozfiles.com/files/1043080/91956959271.pdfIn PDF document text
- https://site-1037160.mozfiles.com/files/1037160/94850876809.pdfIn PDF document text
- https://site-1048471.mozfiles.com/files/1048471/77664603303.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/8553/6159/files/physioex_9.1_exercise_7_review_sheet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/8153/4102/files/7037895704.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/8851/8562/files/bokepolagit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e6ffabf-16a5-46ae-b32b-5d3f71c3166f/38093317449.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aa1925c4-82e1-4d58-8d2a-e40c25afdd6d/makaxax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d8a7d03e-8b8b-490b-8efb-15cddce0cf12/xefugobixovo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/47730d26-e756-460c-b688-bc56f13d645e/49684415125.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69c57aa3-3039-406b-bd52-601dec81e153/53958013586.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/3455/0177/files/baridamirubileko.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/5671/7206/files/rubiwuwewametibak.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/6321/3209/files/itextsharp_add_image_to_existing_c.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/3165/7624/files/wunejuturokukebokugalox.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/7937/1414/files/gallon_of_ice_cream_calories.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6192/6293/files/handy_stitch_instructions.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006b5e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B5E | 5232 bytes |
SHA-256: e0f1bc092492e9a62f34f62e1c3be63a77ac3985ece3355e30b34bd42cb8f697 |
|||
font_01_sfnt_off00007d29.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7D29 | 10032 bytes |
SHA-256: 2f29a5c6bd3fe5f9b5e8d95417cb157752190c0d60f8b2b060658fa8d2d49ebc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.