Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a2bef5951cbf154…

MALICIOUS

PDF

553.5 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 7bf16e91f0a196eff34b8082924c4c29 SHA-1: e53d2242c77d6a2eefd391d048283de2f2422228 SHA-256: 1a2bef5951cbf1548d34e20fdcdf96c11334b78f5286e0e8db390159c8d28994
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file exhibits suspicious characteristics, including embedded files and remote GoTo actions, as indicated by the 'PDF_EMBEDDED_CHILD_STATIC_TRIAGE' and 'PDF_GOTO_REMOTE' heuristics. The ML classifier also flagged it as malicious. These findings suggest the PDF is designed to deliver or redirect to malicious content, potentially through embedded exploits or further stages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
comet_mars_736.pdf
ac45f8c148779e5cad6e5d00d9edc47e9827b0851f87a717c41943dd5068ea1e		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 224337 bytes
comet_mars_736_1.pdf
49861e34e129aec9e351ffee1b8c67ddc11a9955331416da04caf19e6b73778f		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 310844 bytes
comet_mars_736_2.pdf
bbfdded4be42dc4c79095d07801dd6a3fbdc7b08bd3e3ff4aa0647301dfcef13		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 397302 bytes
stream_019_off0001a01e.bin
417c26cba00b5c1e3f747be11f6adfdbc8ee7472bed9cc713e741ca506faa606		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01E 483837 bytes
objstm_0121_00.bin
24e33bb242a16942d3dcde494bcc173dbcc4ee4c526632312f095fd6eabfb500		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1108 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.