Malicious PDF — malware analysis report

Static analysis result for SHA-256 3414d1c76e584d6b…

MALICIOUS

PDF

553.2 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: f12d63647b1384cb7cea1ad542888764 SHA-1: 6d60f446a0fd1958fa8d946e0b7c2bdb9dface7f SHA-256: 3414d1c76e584d6b5c3ea273cbcf0687570103c2b69f2925bc5088837eae29ee
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by multiple heuristics, including critical findings for embedded child PDFs and remote GoTo actions, and a high ML classifier score. ClamAV identified it as 'Pdf.Dropper.Agent-7247557-0', indicating its function as a dropper. The embedded files and remote actions suggest an attempt to load additional malicious content, likely a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7247557-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7247557-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
comet_venus_391.pdf
949f20499d6553904a384fbbdfdf739fa40f596a80c27a3971234bc518600a15		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 224071 bytes
comet_venus_391_1.pdf
6dc4c9aa75f798f6e2ec4cfdf4667bd7123d664f3792403e251d0b1339e701c6		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 310575 bytes
comet_venus_391_2.pdf
096c61c8065e8cf2a07e26f44430e6209decc42b7d7390cf1c3b9566277bb2e2		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 397025 bytes
stream_019_off0001a01e.bin
0df7cc55383b68d509993f8a0b0ae71ea21ebc1d24cfa9ba68aefb6082a09d5d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01E 483556 bytes
objstm_0121_00.bin
7cd1a20233d4b2762e72dd91cb1f0ac086c6a4a6f8ca5c054214ba592ec17c6d		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1111 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.