Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ddd2ed1f3bac281…

MALICIOUS

PDF

835.3 KB Created: 2003-07-07 18:34:32 UTC Authoring application: OmniForm (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2014-11-01
MD5: b2393f4f91106b845c6546f4eeec87dd SHA-1: 335d0706c14e110cf942345e7db043f131a652f7 SHA-256: 4ddd2ed1f3bac28127495ebb000304354db5d08856f2a1b1e0455ab9960ebda0
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and an embedded file, indicating an attempt to execute malicious code. The presence of PDF-specific heuristics like 'PDF_JAVASCRIPT' and 'PDF_JS' strongly suggests the exploitation of a PDF vulnerability. The embedded JavaScript streams are likely responsible for downloading and executing a secondary payload, which is a common attack pattern for PDF-based malware. The high stream count also suggests obfuscation techniques were employed.

Machine Learning

  • Nyx PDF Classifier clean score 0.2229

Heuristics 8

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript issues an HTTP request on open low PDF_JS_NETWORK_BEACON
    Embedded JavaScript calls a network API — this.getURL() to an http(s) URL, XMLHttpRequest, or SOAP — typically an open-time beacon / tracking pixel or data-exfil callback. This abuses a legitimate Acrobat API and exploits no vulnerability; the risk is the unsolicited outbound request (confirming recipient open or fetching a next stage).
    Matched line in script
        if (ans == 1)
        this.getURL("http://www.adobe.com/products/acrobat/readstep.html", false);
}
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.advdelphisys.com/ Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://www.adobe.com/products/acrobat/readstep.hReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/rights/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/t/pg/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://www.adobe.com/products/acrobat/readstep.htmlReferenced by PDF JavaScript
    • http://www.olms.dol.govReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ClientEnvironment pdf-embedded-file PDF EmbeddedFile object 1025 at offset 0x3036F 1002 bytes
SHA-256: beb3462d625d0908f9f83f9eb33269867ac9843b5139ac5d3cda3ffcbda539d9
javascript_obj0014_000.js pdf-javascript-stream PDF /JS object 14 at offset 0x34E9 37 bytes
SHA-256: 44a6b83dbdb1e6c48965b8995a3550391d5dac52fa33d8d1923d1490732fd2a3
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 0, true, 999);
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x3537 42 bytes
SHA-256: 962aad63c51cbc51f1c6a77e44a66c90aea8c3a3fb098089b63a7c478f1d7679
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8e");
javascript_obj0016_002.js pdf-javascript-stream PDF /JS object 16 at offset 0x358C 42 bytes
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false);
javascript_obj0022_003.js pdf-javascript-stream PDF /JS object 22 at offset 0x3930 39 bytes
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false);
javascript_obj0023_004.js pdf-javascript-stream PDF /JS object 23 at offset 0x3980 42 bytes
SHA-256: 4d74edf000b5f86d94bdf341507222595641b84b6c3636fdc626bb159fc7bf25
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8b");
javascript_obj0026_005.js pdf-javascript-stream PDF /JS object 26 at offset 0x3A25 42 bytes
SHA-256: 9cf9e242046e8316232e6b61b869c33fce4c54e1a404405472ecf9ed5ab17119
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8c");
javascript_obj0036_006.js pdf-javascript-stream PDF /JS object 36 at offset 0x3EF6 35 bytes
SHA-256: b3d8d2c964379d3835e2b3678e56f2bf3f58b5b698aa1c98551210177b67f237
Preview script
First 1,000 lines of the extracted script
fmSpawnTemplate("PartB");
javascript_obj0037_007.js pdf-javascript-stream PDF /JS object 37 at offset 0x3F4C 38 bytes
SHA-256: ae95d6581723cae0c2c1e3044a60f6c91e032264799b53449cd6269e6993d7bc
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", true);
javascript_obj0038_008.js pdf-javascript-stream PDF /JS object 38 at offset 0x3F9B 42 bytes
SHA-256: dc0879688f5cf5978ad5e363a629a986091ee6b8dff5fcc299befb80e103ff9f
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8f");
javascript_obj0068_009.js pdf-javascript-stream PDF /JS object 68 at offset 0x4EE6 42 bytes
SHA-256: 5a4a0f637479059c81fa21e097995f5eabc38edb7dd6c1144eee2bc2b457a0bc
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8d");
javascript_obj0077_010.js pdf-javascript-stream PDF /JS object 77 at offset 0x5287 41 bytes
SHA-256: 617ef4da07d9bc9d4e06a2320fe0d4cbacd3d6c2cc82039cf4e79e7facf7545f
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", true);
javascript_obj0121_011.js pdf-javascript-stream PDF /JS object 121 at offset 0x71E6 42 bytes
SHA-256: 3973b4ade658583a583efeee7571e80bb7ae4ab0a055a7ae68f68d86afa39f98
Preview script
First 1,000 lines of the extracted script
fmCheckActivityResponse("Activity.Q8a");
javascript_obj0129_012.js pdf-javascript-stream PDF /JS object 129 at offset 0x776D 158 bytes
SHA-256: cc11613444a93a63b49d2f7b96bc643e4838e9ba8ae2c5d85dca53b00e663baa
Preview script
First 1,000 lines of the extracted script
AFSimple_Calculate("SUM", new Array ("Activity.Q8a.Num", "Activity.Q8b.Num", "Activity.Q8c.Num", "Activity.Q8d.Num", "Activity.Q8e.Num", "Activity.Q8f.Num"));
javascript_obj0140_013.js pdf-javascript-stream PDF /JS object 140 at offset 0x7B9F 34 bytes
SHA-256: 2a1212b706ab177c5bf05f66add37a169884853bb3911a9c2cd778b89b50ab65
Preview script
First 1,000 lines of the extracted script
crCheckForFullField("12");
javascript_obj0146_014.js pdf-javascript-stream PDF /JS object 146 at offset 0x7DE1 44 bytes
SHA-256: a766f29032565697bb3128ff2387b627e6b7e71ac370c0ae394e4ff74cd4f95b
Preview script
First 1,000 lines of the extracted script
crReadyForOverFlowPage(1, "12", -1);
javascript_obj0156_015.js pdf-javascript-stream PDF /JS object 156 at offset 0x8439 34 bytes
SHA-256: dabd6724a83253d5676d9dcc3f512a73bd715cee3bcbd3e001efc693883f0bba
Preview script
First 1,000 lines of the extracted script
crReformatDollarField();
javascript_obj0171_017.js pdf-javascript-stream PDF /JS object 171 at offset 0x8E22 66 bytes
SHA-256: acdff8df76e58dbd69033a1c66317f6da771b37d2201fb5ec5f4632b399379f4
Preview script
First 1,000 lines of the extracted script
crCheckSpawnPageOtherState("Employ", "AgreementDate");
javascript_obj0207_019.js pdf-javascript-stream PDF /JS object 207 at offset 0xA325 43 bytes
SHA-256: 4488be09d0f10a674478298cb82fe916eedd1e8e5109c105e456d6a262513828
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 0, true, 999999999);
javascript_obj0213_020.js pdf-javascript-stream PDF /JS object 213 at offset 0xA719 37 bytes
SHA-256: 19c5eea7c6eacd0b84c5291f694d75e553a960c993dd6534023b9b397b6cdc6f
Preview script
First 1,000 lines of the extracted script
crGoToSignatureBlock("Pres");
javascript_obj0214_021.js pdf-javascript-stream PDF /JS object 214 at offset 0xA770 39 bytes
SHA-256: 47becee72928c07f0382f5fdc0572581404fbe2dceff6e6fab0a957d616e33ed
Preview script
First 1,000 lines of the extracted script
crIsDateGreaterThan("Fiscal.ToDate");
javascript_obj0224_022.js pdf-javascript-stream PDF /JS object 224 at offset 0xAC9C 37 bytes
SHA-256: 37cba162c45cc497ccfabffa10e19a4594277f8f45f4eb07164d1b740dc8aa6c
Preview script
First 1,000 lines of the extracted script
crAcceptUpperCaseCharsOnly();
javascript_obj0235_023.js pdf-javascript-stream PDF /JS object 235 at offset 0xB4F5 57 bytes
SHA-256: 8b8c5067cac1da23ed81e19932c668d6cb0f9c93a30685e09e04c8b6b6a8a9e7
Preview script
First 1,000 lines of the extracted script
crCheckSpawnPageOtherState("Agree", "Independent");
javascript_obj0244_025.js pdf-javascript-stream PDF /JS object 244 at offset 0xB964 38 bytes
SHA-256: 3befb8fc73823e3cda0f41cd2eeb0642e97df820ab638a6483e705f826ff42d1
Preview script
First 1,000 lines of the extracted script
crReformatDollarField();
javascript_obj0270_026.js pdf-javascript-stream PDF /JS object 270 at offset 0xC75A 32 bytes
SHA-256: db6f4013ed490ead63a13d69f3fe45f7744a566c2db0cbc727c1bb9f47e5559e
Preview script
First 1,000 lines of the extracted script
crReformatDollarField();
javascript_obj0289_027.js pdf-javascript-stream PDF /JS object 289 at offset 0xCF27 33 bytes
SHA-256: ede4fde3b887e0cbb751f3b0e21f8a1b403d928e2d00f2b87556159860fe911c
Preview script
First 1,000 lines of the extracted script
fmSpawnTemplate("PartB11");
javascript_obj0894_029.js pdf-javascript-stream PDF /JS object 894 at offset 0x296E0 36 bytes
SHA-256: c8930933e74e2516ade585f50eab1a79f0307ef0320be04cc6d7d2379d10732a
Preview script
First 1,000 lines of the extracted script
crReformatDollarField();
javascript_obj1003_030.js pdf-javascript-stream PDF /JS object 1003 at offset 0x2F383 35 bytes
SHA-256: 77582c9cb8cc8f57c9d7fe8ecbfbc33fb0e8b26fd807cb58288efb61225fb0d9
Preview script
First 1,000 lines of the extracted script
crPrintReportButtonPressed();
javascript_obj1005_031.js pdf-javascript-stream PDF /JS object 1005 at offset 0x2F569 103 bytes
SHA-256: 728e782184cda8a1ab5c1c4a9f28293c2b2a398d34aeea8ea3ccb37d00580617
Preview script
First 1,000 lines of the extracted script
esSignReportButtonPressed("PresSignature", "PrimarySignature", "SecondarySignature");
javascript_obj1007_032.js pdf-javascript-stream PDF /JS object 1007 at offset 0x2F7A4 55 bytes
SHA-256: 961e8c97ac3abc109cc8242bb32fd10dd727caccfa7f589dc849d36a8696af83
Preview script
First 1,000 lines of the extracted script
crGoToFirstPageButtonPressed("Filer.FileNumber");
javascript_obj1009_033.js pdf-javascript-stream PDF /JS object 1009 at offset 0x2F999 48 bytes
SHA-256: a19128f5bc289271bf6ca1b81b331f295f1e90b6439429808237f8df3163534e
Preview script
First 1,000 lines of the extracted script
crPrintErrorSummary("LM-10", "E");
javascript_obj1011_034.js pdf-javascript-stream PDF /JS object 1011 at offset 0x2FB93 54 bytes
SHA-256: 516ec4f4a6d261fe4422e5cdd68c8eadfe18e2faf244b2e58da2c9dbc43f6a33
Preview script
First 1,000 lines of the extracted script
crReadyForOverFlowPage(3, "12", this.pageNum+1);

Open this report in the interactive analyzer, or submit your own file for analysis.