PDF / .PHP malware analysis — malicious · 3bea2d64fd6fdc95

MALICIOUS

PDF / .PHP

783 B

MD5: 086f454095d8907d2b72674898f1d6ed SHA-1: f2d6e00be3275c14f2f054556588c9749803c2e4 SHA-256: 3bea2d64fd6fdc9507675c22b3c5eeaaf03fc8bbb17bed90b40c41060f227520

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell

The PDF file contains a launch action that executes cmd.exe. This command constructs and writes a VBScript payload to disk, which is then likely executed. The VBScript itself is obfuscated but appears to use 'Scripting.FileSystemObject' and 'WScript.Shell' to perform its actions. An embedded URL was also found, which may be used to download further stages.

Heuristics 4

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
/Launch action target: cmd high PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo B="m.vbs":With CreateObject(StrReverse("PTTHLMX.2LMXSM"'.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://10.wenmo.in/x/img.php?d=1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_00000067.bin` `ad55c8e83a5896a04b2012c676820daeab2b84cc539e444c6366e79f55a571c5`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x67	63 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.