Malicious PDF — malware analysis report

Static analysis result for SHA-256 19e5854fb8712c13…

MALICIOUS

PDF

590.5 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: f85f99c81861902e9b33282e8541c0c1 SHA-1: 8d6a808a97e6d2c6058639e840b4db540d16f21a SHA-256: 19e5854fb8712c13c73cf0a05e59ad8df2524652fb8af038fe72192f1fae80be
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1071.001 Web Protocols

The PDF file contains multiple embedded PDF files, indicated by the PDF_EMBEDDED heuristic firings. The ML classifier also flagged this PDF as malicious. The embedded files themselves are likely the primary attack vector, designed to be opened by the user. The presence of embedded files suggests a multi-stage attack where the initial PDF acts as a container for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
pinwheel_jupiter_137.pdf
2e05e3261a056d656a536aa0fc84b3e41054eb0353dc1c1cc99d933e1edab2d4		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 262537 bytes
pinwheel_jupiter_137_1.pdf
9f159299bb8dcdb0e7d46730e4706b658158ef7a9ca5618d2d5be53ea205f2d4		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 348747 bytes
pinwheel_jupiter_137_2.pdf
2a274c9585e823604662875a85e2366e52493b9fe4ebcf7701af343bde1e0314		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F7 435270 bytes
stream_019_off0001a024.bin
66c2fb76cf1853e47042b77ee938fe38d8a15851835cc8904333b032a4bdc508		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A024 521841 bytes
objstm_0121_00.bin
6fc8f36d0d02c121ccf0853811d6917475b15d1e38e1b1063d45c06304510127		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1126 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.