Malicious PDF — malware analysis report

Static analysis result for SHA-256 2416189db50dd9c7…

MALICIOUS

PDF

590.9 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: e4143e0535bd93a7f536d6305e93f0a6 SHA-1: 8905f87c57e4b68c09c69baf82bfdc4b882db057 SHA-256: 2416189db50dd9c7bebee8c178b5d9c9b52144646c0eeb70456a0fe6481fdf9c
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File Execution: Malicious PDF T1059.001 Command and Scripting Interpreter: PowerShell

The PDF was flagged by ClamAV as 'Pdf.Dropper.Agent-7239730-0' and a machine learning classifier indicated a high probability of maliciousness. The 'PDF_EMBEDDED_CHILD_STATIC_TRIAGE' heuristic suggests the presence of suspicious embedded content, likely intended to download and execute a secondary payload. The 'PDF_GOTO_REMOTE' action indicates an attempt to redirect the user, potentially to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7239730-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7239730-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
mayall_earth_30.pdf
98b3c2b8df1e1dd31953cf4633ff747952839aca7d3d7c6b1c41d5086ef6d8f2		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 262721 bytes
mayall_earth_30_1.pdf
91263e40a41e761f512bbbf5d56c3c9209d4dafc16f01d2d3db230f0df102829		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 349182 bytes
mayall_earth_30_2.pdf
68fb8947dbb3c72aad14db6699e190dea25469768e73c5459b3e6c20d8184617		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 435700 bytes
stream_019_off0001a01e.bin
b285e9047cf1a953298a5a7ff52b7c517f4a479982fca0d5b401dd3d6daf4fce		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01E 522261 bytes
objstm_0121_00.bin
dbd0dacb235f78b0fe352f81b4f360c9bd8e6b807cb315a2077befcef0c08bf1		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1111 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.