Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a3622c034244aca…

MALICIOUS

PDF

553.9 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: b11de6be546a7e8b524c3e08973e5317 SHA-1: 61bb8a758abd9f601ffc654bde8ecd3245043e24 SHA-256: 0a3622c034244aca311144d7e079d2bb240a55c298f523e97d79178414b413d9
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded files and a remote GoTo action, strongly indicating it is a dropper. ClamAV detection as 'Pdf.Dropper.Agent-7226794-0' and ML classification further support its malicious nature. The embedded child PDF is the primary mechanism for delivering a secondary payload, likely exploiting a client execution vulnerability.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7226794-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7226794-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
tadpole_earth_341.pdf
152c014b5cf718d150f8ea80e700741d7330a48745c220d9ad0e574e36c62394		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 224849 bytes
tadpole_earth_341_1.pdf
5aef282a8774e2476f4174235781c2e42f0f951ff64bc8ea3aa0965ceec19b79		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 311279 bytes
tadpole_earth_341_2.pdf
912238b431b3fc22724df97444d160769b046a41ef9a4eb0276e56b91f4ece92		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 397759 bytes
stream_019_off0001a01f.bin
30d77d4b997b8b2d504d4d8052054b175ea4b0f27440dc66d504a951861d6251		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01F 484290 bytes
objstm_0121_00.bin
88a9ea7750895a6667ae08bb3d553228d2f315855e529efb2184e29a88d4ad21		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.