Malicious PDF — malware analysis report

Static analysis result for SHA-256 63ffd2def48b0de6…

MALICIOUS

PDF

5.00 MB Created: 2017-11-14 22:41:43 +03:00 Authoring application: Microsoft® Word 2013
MD5: 5571beb23a703556ce72dff35aed34b3 SHA-1: 0d82972a318e6b3bd41a3d34c2cacc0e57afd95d SHA-256: 63ffd2def48b0de662affd793647c4ed38991d8c275465802956ddc94e412d74
360 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains heuristics indicating a launch action that executes cmd.exe, which in turn is used to create and run a VBScript dropper. This dropper is designed to download and execute a second-stage payload, likely leveraging the embedded JavaScript functionality within the PDF. The document body text, though heavily corrupted, contains indicators of payment redirection lures, suggesting a financial scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8280

Heuristics 9

  • Adobe Reader Launch action VBS dropper command chain critical CVE likely CVE_2010_1240_LAUNCH_VBS_DROPPER
    PDF uses a CVE-2010-1240-style Launch action: cmd.exe is invoked from /Launch and builds a VBS stage that uses ADODB.Stream, MSXML2.XMLHTTP, or FileSystemObject to write or execute a payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • PDF JavaScript WScript downloader high PDF_JS_WSCRIPT_DOWNLOADER
    Decoded PDF JavaScript reconstructs a Windows Script Host COM downloader using WScript.CreateObject plus XMLHTTP/ADODB.Stream style download, write, and run behavior. This is commodity payload delivery rather than a specific PDF parser CVE trigger.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://universa.io
    • http://access.universa.io
    • http://bit.ly/2fkELHm
    • http://en.wikipedia.org/wiki/MIT_License
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@
    • http://www.microsoft.com/Typography/0
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoft
    • http://www.microsoft.com/typography/fonts/default.aspx
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00007116.bin
3ae72603aa8ccc31c772c8eb73c792a38310815da09e10872d2cf032a5ced50b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7116 246246 bytes
stream_018_off0006f62f.bin
c62da33cf0c666e726235a7f867f2f8d241d9299941a722107b6fdbd55f6a618		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F62F 4194304 bytes
stream_036_off00108a89.bin
38115f104a2be287d273f27b39fd65875cd50bdf8fc0bb5b5847c59477987bd6		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x108A89 325488 bytes
stream_039_off00134235.bin
a764fce7f04b3c8efbb4281007f70394214dcfcee7b0ed4fa1dc5cd8dfd4fefb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x134235 366360 bytes
embedded_pdf_script_001660f8.bin
b17220fc3915afb4beb9a05807542f943f0e6c608f640e83e7ca0d94cae5182a		 pdf-embedded-script PDF decompressed stream script payload at offset 0x1660F8 5246922 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.