PDF malware analysis — malicious · 04170cb8e1f56d99

MALICIOUS

PDF

485.0 KB Created: 2011-06-22 16:19:29 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 257f0584dfc203648dc1229d11135413 SHA-1: 7846af782e4e00d6148a81ae3b321cd060a4b8b7 SHA-256: 04170cb8e1f56d99be29e302e550c6ecd157a5ea197da444f996fe1674a2f4f3

92 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF contains a marker for the CVE-2008-2551 exploit, which is known to download and execute arbitrary code. The embedded URL points to a CAB file that likely contains the exploit, and another URL is present that likely hosts the secondary payload. The ML classifier also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9724

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000072f.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x72F	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.