PDF malware analysis — malicious · 2d09d16da6d1abb4

MALICIOUS

PDF

107.6 KB Created: 2018-06-12 09:41:10 -04:00

MD5: 15ed3ff22f04c8bfce95c23ae91b5617 SHA-1: c8ab1381e6782b281c3226ec2011893839f3edec SHA-256: 2d09d16da6d1abb46ad5c8feb0e92090d9804052cce062578aed926a6ae020ea

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains JavaScript that triggers a fake Adobe Acrobat update prompt, aiming to deceive the user. Upon user interaction, the script attempts to submit form data to a suspicious URL, likely to download a second-stage payload. The presence of JavaScript and the fake update lure strongly indicate a malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9477

Heuristics 9

PDF auto-runs JavaScript form submission on open critical PDF_OPENACTION_JS_SUBMITFORM

PDF uses /OpenAction to run JavaScript that calls submitForm() with an external HTTP(S) URL. Opening the document triggers the outbound submission path without requiring a normal link click.
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
PDF JavaScript shows fake Acrobat updater prompt high PDF_FAKE_ACROBAT_UPDATE_LURE

PDF JavaScript displays Acrobat/update-themed language such as a document rendering engine update or remote connection to Adobe servers. When paired with JavaScript or external submission, this is a social-engineering lure rather than benign document text.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XUVhsc1FqQjBaRUZUZG1SclpEYzVkVVpLZFhGdFVtNUZVMUJRYzJwa1lXaENiR0V3UmpJMFVHbG1TSFp6UXpOTGJGWmtjRkpRZUVkell6UkZNV2x5YWxac01rOXdPWGh2UVhSRFlXeFFNSHB0YmtoT1oxVlRhVGhyTnpnNFFVVTVPR3hYUW5kSVZVVlZNakE5TFMxb2JUSmpUeTl1UlhGSFZ5OWpMMWR1TDJoUFFtcFJQVDA9LS1mYWVlYjE0ZTE0MzliYmFkMjhiOTVhNGQ1ODhmOWFjYTJhZjE0Y2Jj?cid=990070348#FDF
- https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XWTJoMVJFMUtWMGxMV1ZaRVJVdHFNbFZOTTBzeUwzaGhUalpXZDBseU9XcEdVRVpaT0VOVk1FVTRZelZIVEdFNWRsUkViR3hrV1hkQ1pGUkJkbmh6Wm1obFkyOTVUekZXYnk5WVdWWmpVbEZqTDNscmVrTk5VekpZZUhNMVQyWlJUMjlqTTJwa1MybHlRekV5UVU1U1RUZDRhSGh4V2tNelpHRXdlV28zZEdZd1FVOVZla3huTWpKMWRrWkVhemxVTXpJMlFUQm1iM1ZyWjJwamVGUkxXSFpFWm1ocFNUZDNTbk12UVhaWVNrdFVkbWh4UzBoQlpGZGFiRkZGY1hOaExTMDJRekV6V1hkMVRuUkpjMVpCVlRJdmNFeHJZbEJSUFQwPS0tYzg3Mjk1ZWRlOTk3MWY1MDFhNzM5ZTkyYmU1YjBkOWZjODA5ZTI3MQ==?cid=990070348
- https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XVEhCbGRuaDNSa2syUmxGdGFVa3JOMWx3T1VaWVZWcGtWbTl2ZEV3MmMwOXRSRFZKT0hCbFoyTnljMFpWTVZWUWNWQjFZVGg0VVN0bk9YWjJLekpuU21GSlNHNUplVTFZVkhWdVZpczNObVZGT1dwRmVISmphRVo0T1daT09VVkRWRzVDYkhkb1RGRlNRVFJ6V0ZvM1pVdG9RMUZ0T1ZWeFluSjJjRlJtTkZkc1ozUnNOMEZXVEU1dmVHaE9kR2hJTjNVMVZpOVhiVWh5VUZsdGVGTkZkWEJFTUZCblkxVk1kVEJ1WnpObVNIaExRWFJDWmtaSVEyWmFNVmxyUm5OUExTMURTVlZQTVdFMWFYcHBSa2RPUkc1c1ZIVnlVblYzUFQwPS0tNzM0NGM4Y2YzNDkxYzhmNjlmNzQ4MjBjNjQ3M2I0MjQyYmQ5YTZkMw==?cid=990070348
- https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XVG5CRmVYTkZNakZtWm5ONVpHZHFOV2xpVkhsckwycGlUWEZKTkVoRFYxcHFiMWRNUTJwNVdteG5PRFl6VVV0VVlscEZja2xJSzNOak9YWjVVak5TY0VGSk0zUlJZbTl4TDNkUVlVczFRVEoyU21aNGEwaE9RalZOWm5JcmRFNVlVaXRoUkRaMlYxVmlObVJ3TTBGbmNFNXllakpEUm1Fd1IybGtjMFJMTDNZM1JUaDVhSFJxUm1SR1ZtaFlReXRVU2xsNVRVOTVaMmRsV2psVVpXeFFLM05wTVdSQllpOHdhV3BWWm1OME5VbDRRM1JoTDAxWE5EaHJORk00VWsxcExTMTVhRWRTTW5aak1Fa3dPRWxMTkZsU1V6ZEVOblpCUFQwPS0tNTllZDVmMGIwMmNjNWY4M2YyNzUxZTQ4OTBiOWU2NjEyNjhhODc2NA==?cid=990070348
- https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XWTJoMVJFMUtWMGxMV1ZaRVJVdHFNbFZOTTBzeUwzaGhUalpXZDBseU9XcEdVRVpaT0VOVk1FVTRZelZIVEdFNWRsUkViR3hrV1hkQ1pGUkJkbmh6Wm1obFkyOTVUekZXYnk5WVdWWmpVbEZqTDNscmVrTk5VekpZZUhNMVQyWlJUMjlqTTJwa1MybHlRekV5UVU1U1RUZDRhSGh4V2tNelpHRXdlV28zZEdZd
- https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XWTJoMVJFMUtWMGxMV1ZaRVJVdHFNbFZOTTBzeUwzaGhUalpXZDBseU9XcEdVRVpaT0VOVk1FVTRZelZIVEdFNWRsUkViR3hrV1hkQ1pGUkJkbmh6Wm1obFkyOTVUekZXYnk5WVdWWmpVbEZqTDNscmVrTk5VekpZZUhNMVQyWlJUMjlqTTJwa1MybHlRekV5UVU1U1RUZDRhSGh4V2tNelpHRXdlV28zZEdZd1FVOVZla3huTWpKMWRrWkVhemxVTXpJMlFUQm1iM1ZyWjJwamVGUkxXSFpFWm1ocFNUZDNTbk12UVhaWVNrdFVkbWh4UzBoQlpGZGFiRkZGY1hOaExTMDJRekV6V1hkMVRuUkpjMVpCVlRJdmNFeHJZbEJSUFQwPS0tYzg3Mjk1ZWRlOTk3MWY1MDFhNzM5ZTkyYmU1Y
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/tiff/1.0/
- http://ns.adobe.com/exif/1.0/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `e097c3c9d5bebffbf2500589497c958d9efb3e7c1b169bdac9ec41f5b9f86d69`	pdf-javascript-stream	PDF /JS object 12 at offset 0x180A	639 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0012_001.js` `02c2fde083a2eaed95973161707315783388e31077ab165b3e713a8362d77e83`	pdf-javascript-stream	PDF /JS object 12 at offset 0x1831	103998 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 8 long base64-like blob(s).
`font_00_cff_off00019763.bin` `9340d372ad75a105fdb1627a30e96f892e0dc7d9588c0150cf06b4fa72281cc0`	pdf-font-stream	PDF embedded font (cff) at offset 0x19763	4575 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.