Malicious PDF — malware analysis report

Static analysis result for SHA-256 62df697d3dc4a751…

MALICIOUS

PDF

590.6 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: eebdadf4e8a76c18d1d6b564ca2dce88 SHA-1: 00ad12cc789b94ef97909b147fd705c6ed922f44 SHA-256: 62df697d3dc4a751b75a92a02cb071ef9f2e1f3da0dc2b7476c7dc5e3a015b7a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded files and remote GoTo actions, indicating an attempt to exploit vulnerabilities or redirect the user. The ML classifier also flagged this PDF as malicious with a high probability. While no specific script was extracted, the embedded nature and remote actions suggest a multi-stage attack, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
pinwheel_mars_611.pdf
d382ac1e8a3747392a2bd329fef8fc5a5380f600ad2f95b5277a76e677321b1e		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 262418 bytes
pinwheel_mars_611_1.pdf
efd9f5c5f7ad478ff45dbedeaaabf858b98eb47710530ba3bf3a8f26a6624a74		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 348873 bytes
pinwheel_mars_611_2.pdf
56831179e074b284f72dfaadf06fffec8013dbdff6f0a2e4452c113e5501e867		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 435398 bytes
stream_019_off0001a020.bin
d2764ec279670c2f16e944262c3bb9fea89129d4ecfd278453b571978ad53568		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A020 521960 bytes
objstm_0121_00.bin
a35dc48ad8ef1d2c39af55d114cf3a9beea6c5a7e301afeff9af299f47126a41		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.