Malicious PDF — malware analysis report

Static analysis result for SHA-256 251457517b050efe…

MALICIOUS

PDF

604.3 KB Created: 2011-02-24 09:42:19 +11:00 Authoring application: Adobe LiveCycle Designer 8.0
MD5: 724b38bc8d411a3fa1db5b880f8e67b6 SHA-1: 44a719d896bb2fc9d0d55e2e8d4afa9043e30df6 SHA-256: 251457517b050efeb5efd713fa59203ae18e4c93c4dcc106783717b7aee03cac
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document utilizes XFA forms and embedded JavaScript, triggering multiple high-severity heuristics related to PDF exploits and malicious JavaScript. The document body contains text related to payment, invoices, and bank details, indicating a lure for financial information or to prompt the user to update their software. The JavaScript code attempts to redirect the user to 'http://cgi.adobe.com/special/acrobat/update' which is likely a social engineering tactic to download a malicious payload or exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9583

Heuristics 13

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0
    • https://ocsp.verisign.com0
    • https://ocsp.verisign.com0��
    • http://www.monotype.comHoward
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/exif/1.0/
    • http://ns.adobe.com/photoshop/1.0/
    • http://www.iec.ch
    • http://ns.adobe.com/pdf/1.3/
    • http://cgi.adobe.com/special/acrobat/update
    • http://crl.verisign.com/ThawteTimestampingCA.crl0
    • http://crl.verisign.com/tss-ca.crl0
    • https://www.verisign.com/rpa
    • https://www.verisign.com/rpa01
    • http://crl.verisign.com/pca3.crl0
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
    • https://www.verisign.com/rpa0
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.html
    • https://www.verisign.com/rpa03
    • http://crl.verisign.com/pca3.1.1.crl0
    • http://ocsp.verisign.com/ocsp/status0
    • http://crl.verisign.com/Class3CodeSigningCA2001.crl0
    • https://www.verisign.com/repository/CPS0K
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlCopyright
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlMedium
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.w3.org/1999/xhtml
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.xfa.org/schema/xfa-template/2.1/
    • http://www.xfa.org/schema/xfa-locale-set/2.1/
    • http://ns.adobe.com/xtd/
    • http://ns.adobe.com/xfdf/
    • http://crl.verisign.com/Class3CodeSigningCA2001.crl0��
    • https://www.verisign.com/repository/RPA0
    • https://www.verisign.com/repository/CPS��
    • https://www.verisign.com
    • https://www.verisign.com/repository/verisignlogo.gif0�
    • https://www.verisign.com/CPS
    • https://www.verisign.com/repository/CPS
    • http://www.microsoft.com/truetype/0
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.html
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.html�

Extracted artifacts 25

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0048.bin
c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb		 pdf-embedded-file PDF EmbeddedFile object 48 at offset 0x8D45B 85 bytes
embedded_file_obj0049.bin
8aaf9c7ae09c55a5c59a49dacf07cb47fa01df81181f2eec65bb4a827a220778		 pdf-embedded-file PDF EmbeddedFile object 49 at offset 0x8D50F 3494 bytes
embedded_file_obj0050.bin
71c8c86bb7f45a8f656ccde7300cd717a6e3954169f7006f29655482ec4b940d		 pdf-embedded-file PDF EmbeddedFile object 50 at offset 0x8DA3D 106426 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
embedded_file_obj0051.bin
09cafa7db2c4d1a66eec54523fad5aa408c6d5f720ecfc0072a631b505827180		 pdf-embedded-file PDF EmbeddedFile object 51 at offset 0x93BB8 1477 bytes
embedded_file_obj0052.bin
838c18047c9d1742a502d2eeb49be157ff9801bb3cdd87d0c2fbb39ea189bc13		 pdf-embedded-file PDF EmbeddedFile object 52 at offset 0x93DF4 2400 bytes
embedded_file_obj0053.bin
7e915b5dd2e321929666a7b64c038b67678092d6e43a4a70683521856a4d5128		 pdf-embedded-file PDF EmbeddedFile object 53 at offset 0x940D1 214 bytes
embedded_file_obj0054.bin
b094789276d6faad13f4781393b7e19185bc45b43faea5434af6c491603440c4		 pdf-embedded-file PDF EmbeddedFile object 54 at offset 0x941CC 799 bytes
embedded_file_obj0055.bin
b1b296d371e691ae903fc90e2f3bd69eeac3730137d7c7f5d9379aed02cb51d6		 pdf-embedded-file PDF EmbeddedFile object 55 at offset 0x943DC 110 bytes
javascript_obj0259_000.js
04ceb4c2218e7db19a6e007ca4ce846f92c17fff5eaf3a611e71bbd7a5726917		 pdf-javascript-stream PDF /JS object 259 at offset 0xF3C 1535 bytes
javascript_obj0260_001.js
4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb		 pdf-javascript-stream PDF /JS object 260 at offset 0x1128 870 bytes
javascript_obj0261_002.js
922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc		 pdf-javascript-stream PDF /JS object 261 at offset 0x1283 2798 bytes
stream_024_off00025a11.bin
61f62c6ab38f53bc4792813a8141798d141790e3561c10d8686b5f7bf30bec6f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x25A11 35435 bytes
stream_028_off0005bf09.bin
c70024768d2c352e2ed466198a3c3e8d1c3c4a3ec9cd2bbeec045e5cba81c5c0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5BF09 312899 bytes
generic_stage_recovery_000.js
afa21882abdebc62a2638aa04b9ed8982244469f91903f08a0f3c9b6d7e7954b		 deobfuscated-js generic stage recovery marker-uni-to-%u from decompressed stream at 0x145F6 at offset 0x145F6 88364 bytes
generic_stage_recovery_001.js
ff61465a449bdd88f8c2a6856d25f1f0a3bb2760ca5838dc2ea1b784b56928e9		 deobfuscated-js generic stage recovery marker-uni-to-%u from decompressed stream at 0x25A11 at offset 0x25A11 34402 bytes
generic_stage_recovery_002.js
061bae08a038b9746ee70bf296afa8339d3b643677528b608b52102dc9f2cd38		 deobfuscated-js generic stage recovery null-collapse -> marker-uni-to-%u from decompressed stream at 0x145F6 at offset 0x145F6 73055 bytes
generic_stage_recovery_003.js
7591c60a639bf65972010b556762f8f44531605eee0c5b00a294eb2459eee91e		 deobfuscated-js generic stage recovery split-literal-normalize -> marker-uni-to-%u from decompressed stream at 0x145F6 at offset 0x145F6 88358 bytes
generic_stage_recovery_004.js
fd26ec88788a071dc140936947a918246c2117bd7d066c1d608da8b210374461		 deobfuscated-js generic stage recovery null-collapse -> marker-uni-to-%u from decompressed stream at 0x25A11 at offset 0x25A11 32193 bytes
generic_stage_recovery_005.js
ba802298e34cf7369745aded4b08c9fa094ef4173e28edea98c2b7715f5443a6		 deobfuscated-js generic stage recovery split-literal-normalize -> marker-uni-to-%u from decompressed stream at 0x25A11 at offset 0x25A11 34396 bytes
generic_stage_recovery_006.js
5987438578e2841125dcf296b438e5cb3134b47860f513a45407de3766e2769a		 deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize -> marker-uni-to-%u from decompressed stream at 0x145F6 at offset 0x145F6 73049 bytes
generic_stage_recovery_007.js
b1d1e52c3545f5e0f22fdb1fff0dab61af95ac1b9d0ebf1c0f593354729e5379		 deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize -> marker-uni-to-%u from decompressed stream at 0x25A11 at offset 0x25A11 32187 bytes
font_00_cff_off000098eb.bin
5e07d4564a1a7f2bf3d82e15ceb243eeee4c0d35a3f67572718a6da44bca59fc		 pdf-font-stream PDF embedded font (cff) at offset 0x98EB 5812 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
font_01_cff_off0000ae7c.bin
9b795ac31de8570beab34d0ad10ba066b37c342eedec45257c5b8aeb2cc293da		 pdf-font-stream PDF embedded font (cff) at offset 0xAE7C 3678 bytes
font_02_cff_off0000bbe5.bin
daceb8a63a95e64fa7fab4a2f6a90d6cb2143066732ee6c35cee38a9921efb8b		 pdf-font-stream PDF embedded font (cff) at offset 0xBBE5 3689 bytes
font_03_sfnt_off000145f6.bin
058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145F6 94875 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.