Ramnit PDF malware analysis — malicious · 2d9fbfaa124a3347

MALICIOUS

PDF

111.4 KB Created: ,)ósißÑNY?946ra¾B? Authoring application: w?? UHâ@e%w?wÿu??¬¨F (via w?? UHâ@e%4wi¹Zµy??¢üê¸ìÖ¼GTj¼??Ð¾-E¶P,æjdÛÅ;)

MD5: d641cb89cdf938a78baff5ba854b0255 SHA-1: 4d2ab4e99b642da6d6bc8a3cf0aab9df34c026f4 SHA-256: 2d9fbfaa124a3347fbc1e7609991cf2f195cc23960917e4bcdd85f5fc0ceff4e

212 Risk Score

Malware Insights

Ramnit · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information

The PDF contains embedded VBScript that reconstructs and executes a PE payload. The script uses 'WScript.Shell' and 'Scripting.FileSystemObject' to write the payload to disk as 'svchost.exe' and execute it. This is consistent with the Ramnit family's known behavior of dropping and executing secondary payloads. The ML classifier and ClamAV detection further support this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9926

Heuristics 5

VBScript in PDF stream reconstructs and runs a PE payload critical PDF_VBS_HEX_PE_DROPPER

PDF stream contains an HTML/VBScript block that decodes a long hex string into a Windows executable and runs it via WScript.Shell. This is an embedded dropper payload, not ordinary PDF JavaScript.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0001bbf7.bin` `7c780bff8614ce4598471472398d2a396e630179eefe51e0ed16c19626c98411`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x1BBF7	114049 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`embedded_vbs_dropper_000003a1.vbs` `50b36b292c4a29f5f0d9642bb1487d597e7f817cb538628ff0d791b00e4fac65`	pdf-embedded-script	PDF raw bytes VBScript dropper at offset 0x3A1	113122 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`svchost.exe` `fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320`	embedded-pe	Decoded PE from PDF VBScript dropper at offset 0x3A1	56320 bytes
Detection ClamAV: Win.Trojan.Ramnit-9775455-0 Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.