Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c79f0a8dc375268…

MALICIOUS

PDF

102.5 KB Authoring application: Excel To Pdf .Net 2.8.1.27 (via SautinSoft Company)
MD5: 799c2ec6825326404a44926abf0e8794 SHA-1: 000028d3543257d2f3c5029d7b8e6f60fa775872 SHA-256: 2c79f0a8dc3752683b24999ebccf6abe696f7be8bdd94a7ce399f86ad0823e1b
98 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF contains embedded JavaScript, identified by the PDF_EMBEDDED_SCRIPT_PAYLOAD heuristic. This script is likely responsible for downloading and executing a second-stage payload, as indicated by the EXTRACTED_FILE_STATIC_TRIAGE firing. The script uses String.fromCharCode, a common obfuscation technique. The presence of multiple localhost URLs suggests a potential internal network compromise or a misconfigured attacker infrastructure.

Heuristics 6

  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sautinsoft.com/convert-excel-xls-to-pdf/order-xls-to-pdf-library.php
    • http://localhost:3356/FP/FPCLIENTTest/fp_client/fpspread/5_0_3515_2008/htc/multicolumncombobox.js
    • http://localhost:3356/FP/FPCLIENTTest/fp_client/fpspread/5_0_3515_2008/img/
    • http://localhost:3356/FP/FPCLIENTTest/fp_client/fpspread/5_0_3515_2008/htc/fpspreadie8.htc
    • http://localhost:3356/FP/FPCLIENTTest/fp_client/fpspread/5_0_3515_2008/img/spinner.gif
    • http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
    • http://www.w3.org/1999/xhtml

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00008176.bin
c0db1cc7845a03678306fcee1eaffc01edba4755341f754de66e3c0b0cf4d6f9		 pdf-embedded-script PDF decompressed stream script payload at offset 0x8176 104927 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.