MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cctraff.ru/strik?keyword=comentario+biblico+mundo+hispano+genesis+pdf In PDF document text
- https://cdn-cms.f-static.net/uploads/4368477/normal_5f87fb831331a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f87a798c8b01.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366008/normal_5f88c3fb16542.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371790/normal_5f898485e1986.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370268/normal_5f8921e606ecd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367283/normal_5f8841fad9086.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369772/normal_5f88b4c39ca8e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368230/normal_5f87c36761d53.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/303efee6-d84a-491a-b75c-50682955a0af/dolepabazol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/563b90c5-f6f2-4e92-8b55-14c08505ac66/vajefezufuzawixatakidotum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90c3e2bf-fb2c-4ad4-9f28-1cea8b2512df/rarimupufatazaba.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0500/4387/9594/files/deezer_premium_apk_latest_2020.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/1709/2769/files/usb_complete_the_developers_guide_fifth_edition_jan_axelson.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0268/6717/1508/files/singer_featherweight_2_instruction_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/670f2af9-3bc6-4a83-98a6-6272e145e6f3/89716608132.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f55ae0a9-b689-4c55-8ecd-4dc0f07be15f/26228373163.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df46774d-f4ab-4c70-b02b-6ed144bfb97f/10447483327.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/488a8f23-b0a8-46a6-b729-b05d7aadf8ed/41531168618.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2b1b041-cbed-476c-bc76-eb19949a0efd/muruj.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/9431/8497/files/chicco_double_stroller.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0502/2407/0814/files/java_tutorial_for_beginners.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015fad.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15FAD | 5612 bytes |
SHA-256: 66a907d2ecd4c660575fcfe500871d4e427b1a2a0e4e2975bef53cd7eaf13cca |
|||
font_01_sfnt_off00017282.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17282 | 12236 bytes |
SHA-256: 1c9c1f3ebc39eceb4c5f260a00800fc1defa2c2bf792a4c8bfc62bb85cbeee5a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.