Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a4ca04d40937e2e…

MALICIOUS

PDF

860.4 KB Created: 2010-05-17 09:15:40 +05:00 Authoring application: Photoshop_Album
MD5: 9b3a14f6e9f9378c9dafd3947d1f7cfa SHA-1: d99b605838bdc384e33ee26deb72773d2484a0ce SHA-256: 4a4ca04d40937e2e9e458637ff0027da30cc69dd3b62d1405227dc64a26f18c9
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EMBEDDED_SCRIPT_PAYLOAD. The presence of an eval() call and String.fromCharCode suggests obfuscation. The primary function of the script appears to be downloading and executing a secondary payload, as evidenced by the embedded javascript_obj0072_007.js and embedded_file_obj0156.bin artifacts. The document body is heavily obfuscated and does not provide clear user-facing content, further suggesting a malicious intent behind the PDF's construction.

Heuristics 12

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/xlink
    • http://www.adobe.com/jupiter/template
    • http://ns.adobe.com/AdobeSVGViewerExtensions/4.0/
    • http://www.w3.org/2000/svg
    • http://ns.adobe.com/Extensibility/1.0/
    • http://ns.adobe.com/AdobeIllustrator/10.0/
    • http://www.adobe.com/imageviewer)/Next
    • http://www.adobe.com/getpsalbumstarteredition)/Next
    • http://www.adobe.com/albumreader)/Next
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/xap/1.0/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0156.bin
0e60b2fc6a2bd350089b159201345434371b87be92f99e296110f0aab9464f43		 pdf-embedded-file PDF EmbeddedFile object 156 at offset 0x89E39 66077 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
javascript_obj0072_007.js
7c99a90253ea42a5f4405d8814afa0e351e36b84a2bc499f8ecab0ca7d4924db		 pdf-javascript-stream PDF /JS object 72 at offset 0x9A318 3412 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
stream_000_off0009b2cd.bin
7c49d99496c919f0e68690c73b3dcafe31ffe2e6cd40336ffbd8c28812e2e58f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9B2CD 440897 bytes
stream_002_off000b671c.bin
3ba2b7d095c3e85ec226398e48f576d52f4c9545029a491e721bbd0020804991		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB671C 420359 bytes
stream_003_off000c416e.bin
5e545833bc088174a4342c307859d65cc78c39e43256c7943e55ee21a86f3f44		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC416E 304830 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.