Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ccf708f9d7a2b81…

MALICIOUS

PDF

46.5 KB Authoring application: Poppler-utils
MD5: a6c49e61dcc1330849723c446c2dd3be SHA-1: ee57a48ca1ec3abdb7addbe407007f4d9f1e5857 SHA-256: 8ccf708f9d7a2b819e34f74afe9505d4bc80e079dba35cbefb2b8c6a34a9ce02
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or distributing malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The dominant host 'bankufx.com' is associated with a significant portion of these links, suggesting a coordinated distribution effort.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bankufx.com/uploads/1/3/0/7/130739597/wetes-rebuzus.pdf
    • http://fleabayers.com/uploads/1/3/0/6/130640006/960169.pdf
    • http://rooseveltconservancy.org/uploads/1/3/0/5/130589450/zonosorejifu_zorewepukusole_mujinutik.pdf
    • http://smallrental.com/uploads/1/3/0/6/130622110/69bfa8534.pdf
    • http://kylealpha.com/uploads/1/3/0/5/130550800/7465332.pdf
    • http://mywhiteprivilege.org/uploads/1/3/0/6/130603760/1208527.pdf
    • http://johnsonjaguarband.net/uploads/1/3/0/7/130740259/tipus.pdf
    • http://updanceacademy.com/uploads/1/3/0/4/130476237/4593562.pdf
    • http://dawnhomesut.com/uploads/1/3/0/5/130545189/0102de.pdf
    • http://0to100.ca/uploads/1/3/0/2/130289096/9f38e09e8.pdf
    • http://bearversusbaby.net/uploads/1/3/0/5/130588605/kemuvufofejamiw-murozajewuk-xiwijupo.pdf
    • http://corningfishandgame.org/uploads/1/3/0/7/130739431/1f1f52.pdf
    • http://fitrition.com.au/uploads/1/3/0/6/130605509/vexakevu_jijopibumam.pdf
    • http://tessapaige.net/uploads/1/3/0/5/130539204/betobefoxelozeza.pdf
    • http://walteralbertglobal.com/uploads/1/3/0/5/130551023/zerijowovesiw.pdf
    • http://favefoto.com/uploads/1/3/0/2/130270904/pezesawos_wuvaverapimis_pedom_gipoxejo.pdf
    • http://beingself-centered.com/uploads/1/3/0/5/130540472/130540472.html#apache+camel+set+http+response+code
    • http://0to100.ca/uploads/1/3/0/2/130289096/9f38e09e8

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005945.bin
52504e10876522861ead49563c4940463072f234d222a9282d34754fe16c276f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5945 8504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.