Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ca32687f924a89c…

MALICIOUS

PDF

328.2 KB Created: 2011-04-27 03:04:26 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: a691c575e807e9df27f8921b9a90bab7 SHA-1: 69b8981cc57cdfb2796bd967a3ce5dcf90b34018 SHA-256: 2ca32687f924a89c089478bdb52fd5be719710ea61730b7070d3e6aaa6c71755
76 Risk Score

Malware Insights

The critical heuristic firing for CVE_2008_2551 indicates the PDF exploits this vulnerability to download a payload. The embedded URL http://artisanballoonz.com/system/system.exe is flagged as unknown and is the likely source of the secondary payload. The PDF also contains an embedded JavaScript stream, which could be used to facilitate the exploit or download process.

Heuristics 4

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000418.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x418 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.