Malicious PDF — malware analysis report

Static analysis result for SHA-256 048c2298c3ff5c4c…

MALICIOUS

PDF

590.6 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: dcab7ea038b99c6abcbec4b863358449 SHA-1: a6f626f25969d8a4668eb1194e2f8594370295d6 SHA-256: 048c2298c3ff5c4c9ba2e0b9ac94352a8d924d882e5086dd3a56a9c2419c9e2b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file exhibits suspicious characteristics, including embedded files and remote GoTo actions, which are often used to deliver secondary malicious payloads or redirect users to malicious websites. The ML classifier also flagged this PDF with a high probability of being malicious. While no scripts were directly extracted, the presence of embedded PDFs and remote actions strongly suggests a malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
milky_venus_183.pdf
1b96ddebdde26380135bf3ec4a9ecf265838f14e526b0aadef690ffb9492d356		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 262370 bytes
milky_venus_183_1.pdf
d47c50b33adb82786e24d027f88843697433c0a8b52a1ed487553af7c31089ec		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 348837 bytes
milky_venus_183_2.pdf
5ee7bc80d3ae90f0ffad37977a9c57ff565cad585714629f92eee9865ea81b64		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 435359 bytes
stream_019_off0001a01f.bin
0a79c90c69317b3b39503a9e724ff49b51487ab79038243a51bf0d8ef1ce8f6d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01F 521919 bytes
objstm_0121_00.bin
35a0d8f46f2a486da35be9f9130887ebf8fbee53122f1ee3b87c1a816938a3cf		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1111 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.