C6 Messenger Downloader PDF malware analysis — malicious · 0b5c15dfa1581ff6

MALICIOUS

PDF

344.1 KB Created: 2011-05-26 13:45:25 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 7a2e430c26a6679091a1703d139c217c SHA-1: f928989d7a77b5e278ed9cb1b5515b738dd17994 SHA-256: 0b5c15dfa1581ff69e3816abe16de0015ba3719afe65ba2f222d19c1cf872ec4

92 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF contains a critical heuristic firing for CVE-2008-2551, indicating it exploits this vulnerability to download a payload. The embedded URL 'http://artisanballoonz.com/system/system.exe' is highly suspicious and likely serves as the download location for the secondary malicious executable. The ML classifier also flagged the PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9673

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off000003dd.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3DD	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.