Malicious PDF — malware analysis report

Static analysis result for SHA-256 5744059bd6fdef97…

MALICIOUS

PDF

177.7 KB Created: 2010-06-11 11:09:09 +08:00 Authoring application: Writer (via OpenOffice.org 3.0)
MD5: ea75d9741c10196e1419f1db3c241c1c SHA-1: 20b0af72373115d5657b23bce5df440110f57dc5 SHA-256: 5744059bd6fdef9769a7968b72c031c143eec4ba39603eaf0335a7007bf901fa
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

This PDF file exhibits multiple high-severity heuristic firings, including the presence of JavaScript, RichMedia (Flash), and a suspicious secondary embedded PDF. The ML classifier strongly indicates maliciousness. The embedded JavaScript, particularly the use of unescape(), suggests an attempt to obfuscate malicious code, likely for downloading and executing a second-stage payload. The presence of multiple embedded PDFs further indicates a complex delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9896

Heuristics 8

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000372.bin
07712ee1dc3f626fbcd02bae2b545a3b13a7b148fd797cec119edd28db067d6a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x372 3386 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
objstm_0015_00.bin
cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12		 pdf-objstm-decoded PDF /ObjStm 15 0 obj (inflated) 912 bytes
font_00_sfnt_off0001b04d.bin
2c4b0f1fd3b5e8bff40c8a59a6f1809d3693c44127aa22e95b95663a62f1b92a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B04D 76120 bytes
font_01_sfnt_off00024f6e.bin
1c042371876e105579f838f266a476edc9cb74bd040b5fa71d93fdcfc5197b1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24F6E 10288 bytes
font_02_sfnt_off00026600.bin
981407950c555be0f67f99a94ac51840656713cfa6c89173236cea5b6aa3b0a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26600 42348 bytes
polyglot_child_pdf_off00017bab.pdf
8345e6cec39c08d9b651b66900eec2069f29fa3b5d0d9218ff1a5b80875dad91		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x17BAB 84765 bytes
polyglot_child_pdf_off0002aedb.pdf
0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x2AEDB 6125 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.