Malicious PDF — malware analysis report

Static analysis result for SHA-256 3929acde7862c6b6…

MALICIOUS

PDF

165.4 KB Created: 2008-01-29 00:39:42 +05:30 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 8.1.0 (Windows))
MD5: 11f0a217a4a7ffaa715fa571db60689b SHA-1: cf8aec225af5233337bfc17ef905c461436270cf SHA-256: 3929acde7862c6b67635ee54b6a35a26fc07978ead4c50bda40fca9030cac7d5
266 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The PDF file contains embedded JavaScript and a launch action that executes cmd.exe. This action is designed to exploit CVE-2010-1240, allowing for command execution. The command line indicates an attempt to download and execute a payload, likely named 'payloadpdf.pdf' from the Desktop. The ClamAV detection further confirms its malicious nature.

Heuristics 9

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\payloadpdf.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0064_000.js
6c3485a474a96d4dca89d2e462cb1aee76bd9bcb1be71f6a0d1f07fe4efdcbdc		 pdf-javascript-stream PDF /JS object 64 at offset 0x290E9 59 bytes
stream_015_off0000cf23.bin
0f05a4144cb06f727818977b4353ce000488e7f0fe4faa274a9d0ee41dbbaa4a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCF23 41608 bytes
stream_023_off0001ab4e.bin
cd96484e30f717f5df6f60fe05b231c75cf9ba3ef95003edbb8f1ef0deaee011		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1AB4E 62199 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.68, consistent with packed or encrypted content.
icc_00_off00005c3a.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x5C3A 3144 bytes
font_00_sfnt_off00008aed.bin
bd06756e1c03f7a1894ec3c9e8e44bbc979edb22fe5ac2eb31f52816e715e34e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8AED 12996 bytes
font_01_sfnt_off0000a45a.bin
ee272e921d48adc7ca29b37efad981377cdccd893eebe3525435df14f15f1ccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA45A 21256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.