PDF malware analysis — malicious · 300b4a49920addc4

MALICIOUS

PDF

281.6 KB Created: 2011-04-27 03:28:25 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 95c4d23e8a4ffc7a306288153a7f7252 SHA-1: e75fbe4a461c46ecab857f54706cb274a0305150 SHA-256: 300b4a49920addc4b267563232cc79dcf0f68bd8237fb886dcd379bc465f4f78

60 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The PDF contains a critical heuristic firing for CVE_2008_2551, indicating it exploits a vulnerability to download a payload. The embedded URL http://artisanballoonz.com/system/system.exe is highly suspicious and likely serves as the download location for the secondary malicious executable. The document body is heavily obfuscated and does not provide further clues on the specific lure.

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off0000043a.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x43A	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.