Malicious PDF — malware analysis report

Static analysis result for SHA-256 645d27d71e9c03c9…

MALICIOUS

PDF

86.3 KB Created: 2010-02-10 11:30:14 -06:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 8.2.0 (Windows))
MD5: 76a8535a47652e5756807dab0d2ce20b SHA-1: 9a5b1dc01538bbfc065595da638c13863acf3f7b SHA-256: 645d27d71e9c03c9a11457fd54a17c3b3e86502b11713ee64b469447978c9f41
398 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains a critical launch action targeting cmd.exe, which is exploited in conjunction with an embedded JavaScript dropper. The JavaScript API 'this.exportDataObject' is used to drop and launch a second PDF file named 'spohn.pdf'. This indicates a clear exploit chain designed to execute arbitrary code and deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 11

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\spohn.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • ClamAV: Win.Exploit.Call4_Dword_Xor-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Exploit.Call4_Dword_Xor-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.iec.ch

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
spohn.pdf
5c7b4ff8bdcb69e1a713c7cc37303862a7051374717d465acd62bd19fbabd718		 pdf-embedded-file PDF EmbeddedFile object 39 at offset 0xBF30 38374 bytes
Detection
ClamAV: Win.Exploit.Call4_Dword_Xor-1
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.
javascript_obj0040_000.js
ae58d4de8dbb8a3d504290f1445b61021d7c3cd7783e47c639e8c00a0bdb8cfd		 pdf-javascript-stream PDF /JS object 40 at offset 0x1553E 54 bytes
icc_00_off00004c8f.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x4C8F 3144 bytes
font_00_sfnt_off00009b18.bin
4ecc6360e1328156bebab5ea022691e18648c44316f3e5ce86649dd70207d710		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B18 5884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.