Malicious PDF — malware analysis report

Static analysis result for SHA-256 182bb345c7b99c2e…

MALICIOUS

PDF

414.4 KB Created: 2010-05-17 20:31:16 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: 2d4b34f7e4a6089a56c651cada1ee062 SHA-1: 04e1077ce6d34224788815f2821c2766090b68af SHA-256: 182bb345c7b99c2e972902d58d723d07c9d267ea42af6385bd148ed7aa963408
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by ClamAV as Html.Spyware.IMG-7 and a machine learning classifier indicated a high probability of maliciousness. A hidden HTML iframe was detected within the document, suggesting an attempt to redirect the user to an external resource. While most URLs were benign, one unknown URL was present, which could be the target of the iframe.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9854

Heuristics 3

  • ClamAV: Html.Spyware.IMG-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Html.Spyware.IMG-7
  • PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME
    PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.codeforum.cn/free/max1.htm
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/exif/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/
    • http://www.iec.ch
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000b77b.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB77B 264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.