Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c7dd9f752057c5b…

MALICIOUS

PDF

318.5 KB Created: 2014-04-26 12:25:56 -06:00 Authoring application: LaTeX with hyperref package (via dvips + GPL Ghostscript 9.14)
MD5: c5e67cce52b8774957e776decbdeefb0 SHA-1: e3ac9d9df6d403d067ca64f2d560ac5449d25ea8 SHA-256: 4c7dd9f752057c5b69d0a1965ff90f6031fe7cd3a9e47151af2dbdeab2a62abf
146 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The PDF file exhibits multiple high-risk indicators, including embedded JavaScript, PRC/3D content, and a ML classifier flagging it as malicious. The presence of embedded files like 'equilchord0.prc' and JavaScript streams suggests an attempt to execute code or exploit vulnerabilities. The document body is unreadable, but the combination of heuristics points towards a malicious PDF designed to deliver a secondary payload or exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 9

  • PRC/3D content in PDF high CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
equilchord0.prc
e83a657cdf00c95c811e8a8a561d1e45246e96a91f8d0523375f9b9ea29cdfb3		 pdf-embedded-file PDF EmbeddedFile object 6 at offset 0x1DA7A 193671 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
equilchord0.js
3b571371095cf52709607577db499787585a2ba55338f1123de59e5fab212cf5		 pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x4CD5B 285 bytes
asylabels.js
6898f0072a3b471f184293ec863505b4b3b45a6c723bdf71db7ff92241456910		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x4CE60 2718 bytes
3Dmenu.js
8d2df9d3e8c9ce536fc67d0d94884461aeef604153073de14b958b60abbe7b91		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x4D31F 28676 bytes
javascript_obj0025_000.js
217e8fe85d7f1978d30007b57f260c833cc8b6c2b449be6a818cc44cc2031fc4		 pdf-javascript-stream PDF /JS object 25 at offset 0x4F479 188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.