C6 Messenger Downloader PDF malware analysis — malicious · 6a4c8b21257ad134

MALICIOUS

PDF

52.0 KB Created: 2011-04-22 21:53:46 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 89ee660d4c40aadb37205092be984c36 SHA-1: c660c0b7d6039d01b830dc55ec322e57f7bf1f74 SHA-256: 6a4c8b21257ad134739d910c61941cd5864066a141d33caffb913dc6bee76528

62 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 90%

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is a PDF file that exploits the CVE-2008-2551 vulnerability, commonly associated with the C6 Messenger Downloader. This exploit is designed to download and execute a secondary payload, indicated by the embedded URL pointing to 'system.exe'. The presence of the exploit marker and the embedded URL strongly suggest this attack pattern.

Machine Learning

Nyx PDF Classifier suspicious score 0.3662

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00001179.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1179	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.