Malicious PDF — malware analysis report

Static analysis result for SHA-256 322867c5a6616fab…

MALICIOUS

PDF

591.9 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 2c1440f5470c21c28c7f71bcf40bfba7 SHA-1: 9eee849439f0a73c087ed5503f7848a266c4f7c5 SHA-256: 322867c5a6616faba71526e06663436ec221f4081fc96d7e9b8fd663ae1aabee
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

This PDF file was detected as malicious by ClamAV with the signature 'Pdf.Dropper.Agent-7246561-0'. Static analysis revealed multiple embedded PDF files and suspicious remote GoTo actions. The ML classifier also flagged it with a high probability of being malicious. The primary attack pattern appears to be the delivery of embedded malicious content, likely a dropper for further stages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7246561-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7246561-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cigar_mercury_726.pdf
96553069650a509a4a4b14eaff2eec7e6eb5852e79c9d6541a99efa4c08fcb57		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 263652 bytes
cigar_mercury_726_1.pdf
63398992923b876fbd1c89922338a991347b80eef998eda38a3de6dc33d2e4ce		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 350124 bytes
cigar_mercury_726_2.pdf
2d47173d171743baf03c2d6c00fdeb64de8857da8e99ecd0de135636875896d0		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 436656 bytes
stream_019_off0001a020.bin
61a2ab10193af791f56cda50b78a609232201ee555cd32cedf4774713a32b1b4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A020 523225 bytes
objstm_0121_00.bin
3eb805293f3c2159d79e8cd6776c226037a071fa6abcb2f60eeadaed7c1329ae		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.