Malicious PDF — malware analysis report

Static analysis result for SHA-256 184d379ae2a0c93b…

MALICIOUS

PDF

590.7 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: add15ab88d34e70307874c69ca841ab6 SHA-1: 74889a6fccd9afcd7761798ec013871ca874a684 SHA-256: 184d379ae2a0c93bb951cf82fdb3f097a670d54e034bbf725760a2a393f26271
162 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF was flagged by multiple heuristics, including critical findings for embedded child objects and a remote GoTo action, indicating it's designed to execute malicious code or redirect the user. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a dropper. The embedded nature and lack of readable document body content point towards a file designed to exploit vulnerabilities or download further stages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7233935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7233935-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
magellanic_earth_113.pdf
f51b40864efafa1c1e8e697b3a46940ac354e50babfbf55dce726767e90c25b1		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 262512 bytes
magellanic_earth_113_1.pdf
c3c4607307cfee67e34d29d5efa3c2690339237a6cdde765890e7a76276ceb05		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 348983 bytes
magellanic_earth_113_2.pdf
8f05b379a917102121ae7b2cfbc7352e1277e86a2e0265145a3214a1909025af		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 435491 bytes
objstm_0121_00.bin
bd5d737dc8b7f609b1db1c0312384a7dfe4c79708bce44b54ccc3d6418470f9a		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1126 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.