PDF malware analysis — malicious · 587d1d2089028908

MALICIOUS

PDF

326.6 KB Created: 2024-12-18 13:52:28 +07:00 Authoring application: Microsoft® Word 2016

MD5: 6fdaf0085c8bde4c59a611f0567ae9cf SHA-1: c60c718d412780b424db9a486967cc649d639bb5 SHA-256: 587d1d2089028908d350baeaa6729f596d5ae77c1555e5e3214e5b55a3fe1a4c

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains an embedded script that utilizes a PowerShell download cradle to fetch and execute a secondary payload from the URL 'https://solus.today/files/deb.exe'. The presence of a PowerShell execution command and an embedded script payload strongly indicates a malicious intent to download and run further malware. The embedded URI 'mailto:contact@solus.run' is also noted.

Machine Learning

Nyx PDF Classifier clean score 0.0127

Heuristics 6

PowerShell download cradle in PDF action body critical PDF_PS_DOWNLOAD_CRADLE

PDF contains a PowerShell download-and-execute cradle (IEX/Invoke-Expression of a remote payload, [Net.WebClient]/[Net.ServicePointManager], or `-ep Bypass -enc <base64>`). These strings are rare in benign PDFs and are strong evidence of payload staging in an attack chain (MITRE T1059.001 + T1105).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
External URI low PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://solus.today/addons/contract.pdf
- https://solus.today/files/deb.exe

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_000517e4.bin` `afe562001a146fc3df456b995d4f5fba8f262431078e0ac13ec000dae863f537`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x517E4	334407 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.