Malicious PDF — malware analysis report

Static analysis result for SHA-256 123149d75ba42a74…

MALICIOUS

PDF

68.3 KB Created: 2004-07-05 14:53:21 Authoring application: PDF+Forms 2.0 (via Cardiff Software - TELEform 7.0)
MD5: 5796f8f2052b5c801a3c23c569cde590 SHA-1: 11ea016a39ab33d908ced17be88f08f705ff5dc9 SHA-256: 123149d75ba42a74d9fb0bc7cf7c63036b0e994fa3cf824758ff37b5eb7ce91c
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains JavaScript that is triggered automatically when the document is opened, as indicated by the PDF_OPENACTION_JS_SUBMITFORM heuristic. This script likely attempts to submit form data to the URL https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.SimpleFDFServlet?d=0, which is a critical finding. The presence of PDF_JS_EXPLOIT_CLUSTER and PDF_EVAL firings further supports the malicious nature of the embedded JavaScript, suggesting it may be used for exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7499

Heuristics 9

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • PDF auto-runs JavaScript form submission on open critical PDF_OPENACTION_JS_SUBMITFORM
    PDF uses /OpenAction to run JavaScript that calls submitForm() with an external HTTP(S) URL. Opening the document triggers the outbound submission path without requiring a normal link click.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.SimpleFDFServlet?d=0
    • https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.ImportServ?d=0
    • https://formulare.virtuelles-rathaus.de/servlet/com.burg.ofs2.barcode.BarcodeServlet?design=$&type=pdf417
    • https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.SignServlet?d=5f
    • https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.PayServlet?d=6
    • https://formulare.virtuelles-rathaus.de/servlet/ofs?action=send
    • https://formulare.virtuelles-rathaus.de/servlet/com.burg.pdf.SimpleMailServlet
    • http://www.adobe.com/acrobat/readstep.html

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0166_000.js
6df41228049e9cfb40e870ad866cb0990b2c5c68d8dedf656036b6960c17fe67		 pdf-javascript-stream PDF /JS object 166 at offset 0xBA59 91 bytes
javascript_obj0162_003.js
8c1842de4ccb6a3c96db5313300728b182467d8c490b4d5e0d55a77535907087		 pdf-javascript-stream PDF /JS object 162 at offset 0xBB8D 48 bytes
javascript_obj0165_004.js
9eb3426cfc88396d15a86b175dfd01c1092cd47e0a9c11a3cf9dba46029db0ca		 pdf-javascript-stream PDF /JS object 165 at offset 0xBBE8 83 bytes
javascript_obj0164_005.js
fee55bfb2b9cdc0658a55b80fe1f14a23f0a7ed79f7fd4ce851144fedf36b2c8		 pdf-javascript-stream PDF /JS object 164 at offset 0xBC66 58 bytes
javascript_obj0163_006.js
84391237e30359fab2288524f69e3a5faa52ab0bd4a553b0a541fda146d94ede		 pdf-javascript-stream PDF /JS object 163 at offset 0xBCCB 48 bytes
javascript_obj0001_016.js
52306cde2417459cc9336611090e39725e0bbbc4b8b85b5f5aafa42a2f27b743		 pdf-javascript-stream PDF /JS object 1 at offset 0xF 25596 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
javascript_obj0127_017.js
51b416d40e3fe50ca6cc0f31faaf0a6a5b8bacfb1e4c1e4f8ab8982b62aff890		 pdf-javascript-stream PDF /JS object 127 at offset 0x34E1 948 bytes
javascript_obj0128_018.js
3c4718d5b4722e6302a5956d94c9292ffa8bca5b293d7b4d2fb92ad68b7a1803		 pdf-javascript-stream PDF /JS object 128 at offset 0x37D4 1278 bytes
javascript_obj0129_019.js
37b7eb79892e58dc20ea6975feac49ee9fe3cee1a15414b7be6d53343cdc22b3		 pdf-javascript-stream PDF /JS object 129 at offset 0x3AE8 1948 bytes
javascript_obj0130_020.js
b90d752a956a79317ce850d9dc248626442258f087fc4e591c9c682371ed73d4		 pdf-javascript-stream PDF /JS object 130 at offset 0x3E59 879 bytes
javascript_obj0131_021.js
54beb40673c9298f572cf0e8c0a38f651abec4997320e96d7a66a6aa22fbc19a		 pdf-javascript-stream PDF /JS object 131 at offset 0x4057 4040 bytes
javascript_obj0132_022.js
86fa7b6780ea8978b1a9786befc16005d197f318fd763910910709b2ebe819d2		 pdf-javascript-stream PDF /JS object 132 at offset 0x45D7 136 bytes
javascript_obj0133_023.js
e532a263adcbec75195536eb07e2e8f8230c7155739909c3ee69e555ca9007d1		 pdf-javascript-stream PDF /JS object 133 at offset 0x46C8 375 bytes
javascript_obj0134_024.js
d5cf54804dcdaf9b5c471d084f6e8010c04d2d46a88fab57d73541e59d598b15		 pdf-javascript-stream PDF /JS object 134 at offset 0x4835 1334 bytes
javascript_obj0135_025.js
5dc825a345efe5e078ad9ec1684ba5d192fdd7934134de2e788cee9f8b089aac		 pdf-javascript-stream PDF /JS object 135 at offset 0x4B1E 262 bytes
javascript_obj0136_026.js
edf27b97ca5533b1482f126283f0a169d3dd1dd63059ba0201e8599590339d98		 pdf-javascript-stream PDF /JS object 136 at offset 0x4C63 4720 bytes
javascript_obj0179_027.js
87ff8c55e8dbc6af782adf303f37e8d1d56468909f069bec29d560bd955abaab		 pdf-javascript-stream PDF /JS object 179 at offset 0xBF56 8121 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.