Malicious PDF — malware analysis report

Static analysis result for SHA-256 237f3a479c097d64…

MALICIOUS

PDF

151.0 KB Created: 2011-03-27 11:47:35 -05:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Acrobat Distiller 8.2.6 (Windows))
MD5: 8a813443f61ca2ddea092d47a48034f0 SHA-1: 9e06bf6695b5faf902ef24422fbfbee2a970ee7b SHA-256: 237f3a479c097d64ef253135b56d8183617724e2da84ddd7b62bbe9b4d42214e
74 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT', 'PDF_JS', and 'PDF_EVAL'. The 'eval()' call within the JavaScript stream is highly suspicious and suggests the execution of obfuscated code. While the specific payload is not directly visible due to obfuscation, the presence of 'eval()' and the 'Suspicious extracted artifact' heuristic strongly indicate that this script is designed to download and execute a second-stage payload. No specific malware family could be confidently identified.

Heuristics 7

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_004.js
5e642e2bdb7880e08b7968d05a56c80b0497d41ea1b44014a7d279fc2d9f318d		 pdf-javascript-stream PDF /JS object 1 at offset 0xF 1746 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
icc_00_off000164c7.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x164C7 3144 bytes
font_00_sfnt_off00004ca4.bin
5e453106bb36acda030ebcb28a47ddb2789cc6172f9afe9422bfde11a8153bd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CA4 100948 bytes
font_01_sfnt_off0001bdbc.bin
9834a6d756d001b6d092c3986f883ef38ceb0f1926b664beafcda5acf98aa3e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BDBC 22316 bytes
font_02_sfnt_off0001fd12.bin
79a0a3a5870fad508a7911d10b0b3487a4b01c74f8d84c99eec579154722546b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FD12 19945 bytes
font_03_sfnt_off000236fe.bin
e0c319374e34f9e253e856ffb1ce7b8182f44b42c7f4914859ec926a53c4d2b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x236FE 10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.