MALICIOUS
194
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ggtraff.ru/strik?keyword=ruger+10+22+takedown+manual+pdf In PDF document text
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/ffa66d1.pdfIn PDF document text
- https://tiwilofudux.weebly.com/uploads/1/3/1/6/131606348/bitakaka.pdfIn PDF document text
- https://mujunoba.weebly.com/uploads/1/3/2/6/132682006/0073ff9ae78b4fa.pdfIn PDF document text
- https://digonowokeke.weebly.com/uploads/1/3/1/8/131856318/kulow.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365656/normal_5f874c7fa90c7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370078/normal_5f889814b4e62.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366312/normal_5f870f015d95b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366666/normal_5f8731179640b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372955/normal_5f895c2cc3d7e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f870851d4cda.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/4eda7178-5810-46fe-872f-479fa02a9005/duboguwoja.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/893141f2-824d-4699-9705-0c299d91bf97/15870710433.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b2051b4-8942-482b-b4b8-9a8b6eca1fa5/96848247168.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8abd5cbb-8fbd-4fb0-9632-8e9ad8f4f346/83201105941.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4f3ce1d-ce3f-479f-a610-60a36d3ba730/49809728023.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c11dc958-e3c7-46e5-ae40-53c5e98e218f/5431179838.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73c6dc1d-7a91-43df-920f-87fada2dff2f/40380939741.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45f0c274-78c3-407b-baf6-7794cd66f62c/74970702832.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/227d8f00-abcc-45b1-ad29-f7adb2bd6c36/barot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83715be0-ec06-4e5b-b1df-6825a0886a40/42219232846.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e7dda18-6a5e-490d-8cf7-9878bbc0f532/kizatasevukawebenosajut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/492763ae-fd45-4982-9dea-ddd17d0c6132/47523279105.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000a26f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA26F | 5504 bytes |
SHA-256: d477955b2aff6a2e9e8acebe6ceaaf7b4f14f489ff80b9f29f8ad24bd82ed4e1 |
|||
font_01_sfnt_off0000b536.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB536 | 10844 bytes |
SHA-256: 03f0305abc92ba057e1dadf9f705a0a031c6b068af4703e548abef991a8e3723 |
|||
font_02_sfnt_off0000d9c5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD9C5 | 4324 bytes |
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.