C6 Messenger Downloader PDF malware analysis — malicious · 0f28f614c66980a9

MALICIOUS

PDF

343.8 KB Created: 2011-05-17 08:41:19 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 34297b796286fbf96f3e4adee9a5eaa8 SHA-1: 7150590ce5b0e07b983464abc3f744201d58ddda SHA-256: 0f28f614c66980a9dcf528ea5adad70abed3e98461950d1d12e8014c4f85b80e

92 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF contains a marker indicating the CVE-2008-2551 exploit for DownloaderActiveX. The embedded URL points to a .cab file, and another URL is present that likely hosts the secondary payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9841

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000401.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x401	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.