Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dcb9acb5cbf8164…

MALICIOUS

PDF

553.5 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 084a9739f93b02aa25d97e19f8b3377a SHA-1: 34065324d9250121c5edd591a484b945261d4a35 SHA-256: 4dcb9acb5cbf81646f6dce84e3072635414e1a457f0872d60fa53f9cbfbd4188
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF contains embedded files and a remote GoTo action, indicating an attempt to redirect the user or load external content. The ML classifier strongly suggests malicious intent. The embedded PDF child stream has suspicious static findings, including PDF_GOTO_REMOTE, which points to a potential exploit. The primary attack vector appears to be leveraging a PDF vulnerability to download and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
comet_earth_769.pdf
36136faaa46ee53508df9c01692dcad6f9c56a9a695d82bd8b42136ec0903b45		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 224369 bytes
comet_earth_769_1.pdf
97003ac5274d218f22a5e9ad3e92f13a353e2ff9a2e6c9af7b16dd124df294e9		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 310881 bytes
comet_earth_769_2.pdf
38b3cda5b10d7b9ed7401078ac0fb57ada8ba2b17a5cb85fc98fcff1d1e2a487		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 397339 bytes
stream_019_off0001a01e.bin
824e157424ebd63eb9b2280e70aae61a76648c6d3e42d46dcb50f535bd6c3030		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01E 483872 bytes
objstm_0121_00.bin
f041418d503350f6f844a6c81d84314ded4ab6dbb19170550959f1868d0e0cfd		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1111 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.