Malicious PDF — malware analysis report

Static analysis result for SHA-256 606e8f9c59a36766…

MALICIOUS

PDF

239.0 KB Created: 2017-11-28 05:03:21 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: 4abda5580b3e8e1a4a5273e2b05319d9 SHA-1: 6b264ad5c2aa01e35abcad5da0877dd2fe670f1b SHA-256: 606e8f9c59a3676614ba3335be02dbb67294665c29f20ca5cda9f532b109c1e0
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded JavaScript that attempts to redirect the user to external websites. The ML classifier strongly indicated maliciousness, and the embedded links point to potentially malicious domains. The embedded script's primary function appears to be facilitating navigation to these external sites, likely as part of a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 5

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.lnt.eng.br/armacon.html
    • http://www.multcalc.com.br/calcvigas.html
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000bb4a.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBB4A 264072 bytes
embedded_pdf_script_0003acfa.bin
fe3705fd7925429aacfd570c2b214ba47d94df6a46d3f73e8bc0370dea4d7370		 pdf-embedded-script PDF decompressed stream script payload at offset 0x3ACFA 244745 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.