Malicious PDF — malware analysis report

Static analysis result for SHA-256 10a569b64e55da7b…

MALICIOUS

PDF

119.9 KB First seen: 2019-03-18
MD5: 027ac44c9b42bf5ef84a7695584fb0bb SHA-1: 0dba976db1470fe5589174a1d87d9d330c89f24d SHA-256: 10a569b64e55da7bf07ef1431998fc1c1499727dc40bdcc0806983011f229ec0
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains embedded JavaScript and other embedded files, indicating an attempt to deliver a malicious payload. The JavaScript action points to a URL that, while benign in reputation, is used in conjunction with other heuristics to trigger the payload. The ML classifier also flagged this PDF as malicious, supporting the conclusion that it is designed to execute malicious code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6789

Heuristics 7

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 In extracted file (font_00_sfnt_off00000cda.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0001.bin)
    • http://www.xfa.org/schema/xci/2.6/In extracted file (embedded_file_obj0002.bin)
    • http://www.xfa.org/schema/xfa-template/2.6/In extracted file (embedded_file_obj0003.bin)
    • http://www.w3.org/1999/xhtmlIn extracted file (embedded_file_obj0003.bin)
    • http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0003.bin)
    • http://www.xfa.org/schema/xfa-template/2.8/In extracted file (embedded_file_obj0003.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In extracted file (embedded_file_obj0004.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0007.bin)
    • http://www.xfa.org/schema/xfa-form/2.8/In extracted file (embedded_file_obj0008.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_00_sfnt_off00000cda.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_00_sfnt_off00000cda.bin)
    • https://www.verisign.com/rpaIn extracted file (font_00_sfnt_off00000cda.bin)
    • http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn extracted file (font_00_sfnt_off00000cda.bin)
    • https://www.verisign.com/rpa0In extracted file (font_00_sfnt_off00000cda.bin)
    • http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In extracted file (font_00_sfnt_off00000cda.bin)
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn extracted file (font_00_sfnt_off00000cda.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x1A3FB 163 bytes
SHA-256: b4f489c16aacc4a3f62fba78d0e26e3c5f9d58180e0002f060262d6b24b610de
embedded_file_obj0002.bin pdf-embedded-file PDF EmbeddedFile object 2 at offset 0x1A4ED 1737 bytes
SHA-256: a2e48ea644de8f080e6db83402c62c260ea5e4b0531d82695031b7c65fe55862
embedded_file_obj0003.bin pdf-embedded-file PDF EmbeddedFile object 3 at offset 0x1A813 32933 bytes
SHA-256: 8ac72902ae334fe392ebaf4ce645554a8cebdc64a82138cd7895e8e2fda2b450
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
embedded_file_obj0004.bin pdf-embedded-file PDF EmbeddedFile object 4 at offset 0x1C0E4 2860 bytes
SHA-256: bfff1586053f8005ff03b85b76471914c8ed164445b816ae476d50b551f1e7c8
embedded_file_obj0005.bin pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x1C43A 286 bytes
SHA-256: 609985086b771be0c4047efe6ddb5e77a2d617b3e3e0582da6d7979aabf15a58
embedded_file_obj0006.bin pdf-embedded-file PDF EmbeddedFile object 6 at offset 0x1C513 1535 bytes
SHA-256: 0c13e9948a450ac7f952faeb7598cdd87c762454256478c6419a022f5ffcf091
embedded_file_obj0007.bin pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x1C7D2 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x1C87B 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
stream_002_off000003b6.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3B6 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
stream_003_off00000594.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x594 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
objstm_0088_00.bin pdf-objstm-decoded PDF /ObjStm 88 0 obj (inflated) 10953 bytes
SHA-256: b12e5b9e1aa2e365e3e74c7092d4789e3d446ae41dd2f8f932b2aa87272911a0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).
font_00_sfnt_off00000cda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDA 94351 bytes
SHA-256: 1626e6329f65d0d35cdf751ec668ac4b8800d726707d01e7810bb8297d789dee
font_01_sfnt_off00012d29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D29 16787 bytes
SHA-256: 8105cd178d7984f2d4d960eb1f7e1687c30b3d76d7851e2c5393f97419ea12cc
font_02_sfnt_off00015714.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15714 26335 bytes
SHA-256: 84f9426d9ffbd2b8642cb75387a3205b4603a9aa82cc807a6edde559726342c9

Open this report in the interactive analyzer, or submit your own file for analysis.