Malicious PDF — malware analysis report

Static analysis result for SHA-256 59720e783301c5ee…

MALICIOUS

PDF

51.5 KB Created: 2011-05-17 09:19:12 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: c83956ab55a6e0f6a3aa55c2d84456e4 SHA-1: 8daa986ad80976c203b29eebc82dcc984a56041b SHA-256: 59720e783301c5eed4193b116ed3bc504c5f0cf91879a052ada9a67737ed45bb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The sample is a PDF document that contains a critical heuristic firing for CVE_2008_2551, indicating it exploits a vulnerability to download a payload. The embedded URL 'http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1' and the external URI 'http://artisanballoonz.com/system/system.exe' suggest the download of an ActiveX control or an executable. The document body contains numerous benign URLs, likely for obfuscation, but the primary malicious intent is driven by the exploit.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=840728
    • http://www.farsnews.com/newstext.php?nn=8809221138
    • http://www.irna.ir/View/FullStory/?NewsId=839237
    • http://www.farsnews.com/newstext.php?nn=8809221807
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000fe2.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xFE2 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.