Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f7e7c1e4e035483…

MALICIOUS

PDF

917.3 KB Created: 2000-04-02 18:27:16 Authoring application: Anarchists Cookbook v2000 - Microsoft Word (via Acrobat PDFWriter 4.0 for Windows)
MD5: ae4d55332719b1f5a226ea0c39b3529f SHA-1: d805c885339a89efb795220443e20352c1382c01 SHA-256: 5f7e7c1e4e0354837260eeacce9458bbb5fcaacb0e1830993970a6aaecdc88a9
570 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript that triggers a launch action, executing cmd.exe. The JavaScript also attempts to export a data object named 'p', which is likely the malicious executable disguised as a PDF. The embedded artifact 'p.pdf' has been identified as a Windows executable by ClamAV, confirming the malicious intent. The document's structure and heuristics indicate a lure for advance-fee scams or payment redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 15

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\p.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
p.pdf
fb876296a900a1eae89a9cd686108a548364981e9550a2168913319ca0ce30a3		 pdf-embedded-file PDF EmbeddedFile object 934 at offset 0xE038D 37888 bytes
Detection
ClamAV: Win.Trojan.Agent-916188
Obfuscation or payload: unlikely
javascript_obj0935_000.js
35bb4a02c1abb2bb25a9524a3a41f6f23a69312bbcefc8dca40fbd883f1d55ae		 pdf-javascript-stream PDF /JS object 935 at offset 0xE50DD 50 bytes
stream_126_off0006ce8d.js
d1538b2482aa8da3d99ca2b0b77fb9cceb48cd8d2f01eb2024ad7352b1667429		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6CE8D 9151 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.