C6 Messenger Downloader PDF malware analysis — malicious · 66da7879d57d486a

MALICIOUS

PDF

50.1 KB Created: 2011-04-22 21:43:54 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 4d434752369d2c05d732898ace9d4362 SHA-1: c0217bbae59be937a7f962205422296530af8be0 SHA-256: 66da7879d57d486a6df44f560361bf2132eb19050c614000fe13877273b99528

62 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 85%

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is a PDF file that contains a marker for the CVE-2008-2551 exploit, which is known to download and execute arbitrary code. The embedded URL 'http://artisanballoonz.com/system/system.exe' likely serves as the secondary payload. The benign reputation of the other embedded URL suggests it is not part of the malicious chain.

Machine Learning

Nyx PDF Classifier suspicious score 0.2812

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000a40.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xA40	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.