PDF malware analysis — malicious · 5216ca6cf0810c30

MALICIOUS

PDF

72.7 KB Created: 2010-05-29 04:10:48 +00:00 Authoring application: ReportLab http://www.reportlab.com

MD5: 535c65a574b103f071c86196c0e45798 SHA-1: 3b7c3603cb7e89480112524cca77601b286e1c7c SHA-256: 5216ca6cf0810c3064403ed1cfcbce9775b67790d186ca8868d4690e9e4e9e58

94 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: User Execution T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a direct link to an executable or archive payload, disguised as a Wikipedia link related to payment services. The presence of PDF_DIRECT_PAYLOAD_LINK and PDF_URI heuristics strongly indicates a malicious intent to trick the user into downloading and executing a payload. The document body and extracted URLs reinforce the theme of payment services, suggesting a phishing or scam lure.

Heuristics 7

PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK

PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.reportlab.com
- http://en.wikipedia.org/w/index.php?title=Payment_service_provider
- http://en.wikipedia.org/w/index.php?title=24x7payments.com
- http://en.wikipedia.org/w/index.php?title=AlertPay
- http://en.wikipedia.org/w/index.php?title=Barclaycard_ePDQ
- http://en.wikipedia.org/w/index.php?title=Beenz
- http://en.wikipedia.org/w/index.php?title=Bucks_Net
- http://en.wikipedia.org/w/index.php?title=CyberBucks
- http://en.wikipedia.org/w/index.php?title=DigiCash
- http://en.wikipedia.org/w/index.php?title=CyberCoin
- http://en.wikipedia.org/w/index.php?title=Datacash
- http://en.wikipedia.org/w/index.php?title=ECash
- http://en.wikipedia.org/w/index.php?title=Elavon
- http://en.wikipedia.org/w/index.php?title=FasterPay
- http://en.wikipedia.org/w/index.php?title=Firstgate
- http://en.wikipedia.org/w/index.php?title=Flooz
- http://en.wikipedia.org/w/index.php?title=Heidelpay
- http://en.wikipedia.org/w/index.php?title=HSBC
- http://en.wikipedia.org/w/index.php?title=IKobo
- http://en.wikipedia.org/w/index.php?title=IKP
- http://en.wikipedia.org/w/index.php?title=LibertyReserve
- http://en.wikipedia.org/w/index.php?title=MagicMoney
- http://en.wikipedia.org/w/index.php?title=Microeuro
- http://en.wikipedia.org/w/index.php?title=MicroMint
- http://en.wikipedia.org/w/index.php?title=Micromoney
- http://en.wikipedia.org/w/index.php?title=MilliCent
- http://en.wikipedia.org/w/index.php?title=Mondex
- http://en.wikipedia.org/w/index.php?title=Moneybookers
- http://en.wikipedia.org/w/index.php?title=MPAY24
- http://en.wikipedia.org/w/index.php?title=NetCash
- http://en.wikipedia.org/w/index.php?title=Ouroboros
- http://en.wikipedia.org/w/index.php?title=Pago
- http://en.wikipedia.org/w/index.php?title=PayMe
- http://en.wikipedia.org/w/index.php?title=PayPal
- http://en.wikipedia.org/w/index.php?title=PayPay
- http://en.wikipedia.org/w/index.php?title=PayPoint.net
- http://en.wikipedia.org/w/index.php?title=PaySafeCard
- http://en.wikipedia.org/w/index.php?title=PayYourRent.com
- http://en.wikipedia.org/w/index.php?title=PayXpert
- http://en.wikipedia.org/w/index.php?title=PayWord
- http://en.wikipedia.org/w/index.php?title=PeerTransfer
- http://en.wikipedia.org/w/index.php?title=Peppercoin
- http://en.wikipedia.org/w/index.php?title=Qunits.net
- http://en.wikipedia.org/w/index.php?title=RBS_WorldPay
- http://en.wikipedia.org/w/index.php?title=Realex
- http://en.wikipedia.org/w/index.php?title=RentPayment
- http://en.wikipedia.org/w/index.php?title=Sage_Pay
- http://en.wikipedia.org/w/index.php?title=Safecharge
- http://en.wikipedia.org/w/index.php?title=Secure_Trading
- http://en.wikipedia.org/w/index.php?title=SIX_Card_Solutions_GmbH
+10 more URL(s)

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0090.bin` `95e382e53445b374efa5bfa4deb4e313a13f82d2d23d4b877b8b2162af3b139a`	pdf-embedded-file	PDF EmbeddedFile object 90 at offset 0xE204	31829 bytes
`embedded_file_obj0088.bin` `d81baa73e490e4cb879e13927cacd1dd1be37524a37eac51603e15117c578777`	pdf-embedded-file	PDF EmbeddedFile object 88 at offset 0x115E3	84 bytes
`embedded_file_obj0089.bin` `24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0`	pdf-embedded-file	PDF EmbeddedFile object 89 at offset 0x11695	228 bytes
`embedded_file_obj0091.bin` `c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460`	pdf-embedded-file	PDF EmbeddedFile object 91 at offset 0x11786	199 bytes
`embedded_file_obj0092.bin` `846dfecc0c93797cb6db4301f6af323fffd76ffdf8c053c439495412785138e7`	pdf-embedded-file	PDF EmbeddedFile object 92 at offset 0x11877	119 bytes
`embedded_file_obj0093.bin` `e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876`	pdf-embedded-file	PDF EmbeddedFile object 93 at offset 0x1192F	77 bytes
`embedded_file_obj0094.bin` `92a3ce61d783e15932b5de127ce45a9b4c2f98f4da2453f65241573c1dda808a`	pdf-embedded-file	PDF EmbeddedFile object 94 at offset 0x119D6	56 bytes
`stream_001_off000047d7.bin` `dd61f9b7e9810726b48da8ef71fccdf9703f17e2db2b306fbf30e6ddffb21e06`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47D7	14096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.