PDF malware analysis — malicious · 02f4d7176e6aaf85

MALICIOUS

PDF

2.23 MB Created: 2007-02-04 17:58:32 +07:00 Authoring application: G:\ProgramFiles\Microsoft Office\OFFICE11\WINWORD.EXE (via Foxit PDF Creator Version 1.0)

MD5: f39cc7a79698887640a3cc3991b48c34 SHA-1: c06492250722f43f5a7e8fa38cb2b10cafbf5769 SHA-256: 02f4d7176e6aaf85b0f7874db55630e9132c375ed21e75531d27a83a380db7b0

400 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains a critical PDF_LAUNCH heuristic firing, indicating an attempt to execute an external command. Specifically, it targets cmd.exe with parameters that suggest a VBS dropper, as also indicated by the CVE_2010_1240_LAUNCH_VBS_DROPPER heuristic. The embedded script, identified as a WScript downloader, likely facilitates the download and execution of a second-stage payload, making this a malicious document designed for initial execution.

Machine Learning

Nyx PDF Classifier malicious score 0.8245

Heuristics 10

Adobe Reader Launch action VBS dropper command chain critical CVE likely CVE_2010_1240_LAUNCH_VBS_DROPPER

PDF uses a CVE-2010-1240-style Launch action: cmd.exe is invoked from /Launch and builds a VBS stage that uses ADODB.Stream, MSXML2.XMLHTTP, or FileSystemObject to write or execute a payload.
Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
PDF JavaScript WScript downloader high PDF_JS_WSCRIPT_DOWNLOADER

Decoded PDF JavaScript reconstructs a Windows Script Host COM downloader using WScript.CreateObject plus XMLHTTP/ADODB.Stream style download, write, and run behavior. This is commodity payload delivery rather than a specific PDF parser CVE trigger.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.iec.ch

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_001e255b.bin` `1ae693f0eae6b0894f911e2e91445e8dbb796834a6bff0b5fce3d0c3f90c82d6`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x1E255B	2340754 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s).
`icc_00_off00000072.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x72	3144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.