Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a7447d6a05d94f1…

MALICIOUS

PDF

53.6 KB Created: 2011-06-22 16:39:07 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 7368536c52f7ab9c266aa28d6f9be917 SHA-1: 1cd138c512958688b6e6750ffded790cd4d89574 SHA-256: 2a7447d6a05d94f143eb232c6841102ffb1cbfc2b000bf5bd0e3264c1158651f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The sample is a PDF document that contains a critical heuristic firing for the C6 Messenger DownloaderActiveX exploit. This exploit is designed to download and execute a second-stage payload. The presence of an embedded URL pointing to 'system.exe' on 'artisanballoonz.com' strongly suggests this is the intended payload. While most extracted URLs are benign, the exploit and the unknown-reputation URL are key indicators.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.presstv.ir/Persian.aspx?id=10358
    • http://www.irna.ir/View/FullStory/?NewsId=1151206
    • http://www.presstv.ir/Persian.aspx?id=10353
    • http://www.irna.ir/View/FullStory/?NewsId=1149715
    • http://www.iribnews.ir/Default.aspx?Page=MainContent&news_num=228558
    • http://www.iribnews.ir/Default.aspx?Page=MainContent&news_num=228516
    • http://www.iribnews.ir/Default.aspx?Page=MainContent&news_num=228526
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000017d8.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x17D8 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.