Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a85416064e8b0f9…

MALICIOUS

PDF

248.2 KB Created: 2010-07-18 18:07:06 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: b5216a5a73d566a30fa9e9ac497a537e SHA-1: e69535cd781a27c069c9cb407a2a6f3859d3b2dd SHA-256: 6a85416064e8b0f971f7b4e15ff0053499c94cce1a10cfbddd1b0654b30fcc44
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript that utilizes `eval()` and `unescape()` functions, indicating obfuscation and likely malicious intent. The script also contains URI links that mimic Joomla website article links, suggesting a phishing or redirection scheme. These elements, combined with a high ML classifier score, strongly suggest exploitation for client execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 5

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Germs+found+on+foods
    • http://www.miperumarket.com/mnbvf/rnct.php?arg=Dog+won%27t+eat+dog+food
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+chemistry+journal+carbohydrates
    • http://www.gadiago.org/pligg/jzrn.php?arg=worksheets+sandra+heyer+easy+true+stories
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=American+home+food+products
    • http://www.gadiago.org/pligg/jzrn.php?arg=painted+antique+chest+beautiful+deal
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+with+long+chain+carbons
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Natri+dog+food
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Health+foods+algae
    • http://www.vaqua.biz/home/tasr.php?arg=Foods+from+west+aftica
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Types+of+healthy+foods
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Slimming+world+free+food
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=How+long+do+refrigerated+foods+keep
    • http://www.gadiago.org/pligg/jzrn.php?arg=yahoo+blank+planning+calendar
    • http://www.gadiago.org/pligg/jzrn.php?arg=southeast+asia+map+blank
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Telephone+number+wico+foods
    • http://www.miperumarket.com/mnbvf/rnct.php?arg=Jarred+baby+food
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Dorchester+ma+whole+food+store
    • http://indianpharmacynoprescription.com/products/blood_pressure_heart/trental/order/
    • http://indianpharmacynoprescription.com/products/men_s_health/ultimatecialispack/order/
    • http://www.vaqua.biz/home/tasr.php?arg=Clib+art+of+food
    • http://www.vaqua.biz/home/tasr.php?arg=Calcium+lowering+foods+calcitriol
    • http://indianpharmacynoprescription.com/products/antibiotics/cefaclor/order/
    • http://indianpharmacynoprescription.com/products/antibiotics/rulide/order/
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Best+food+for+puppy
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+game+2009+jelsoft+enterprises+ltd
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+staple+france+production
    • http://www.gadiago.org/pligg/jzrn.php?arg=understanding+sadness+worksheets+and+activities
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+quantity+estimator+graduation+party+planning
    • http://www.vaqua.biz/home/tasr.php?arg=Mexican+food+resturaunt+in+lindale+texas
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Popular+foods+in+bahama
    • http://www.vaqua.biz/home/tasr.php?arg=Wysong+organic+animal+food
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Canned+foods+for+community+service
    • http://indianpharmacynoprescription.com/products/antibiotics/erythromycin/order/
    • http://www.gadiago.org/pligg/jzrn.php?arg=printable+verb+worksheets+for+3rd+grade
    • http://www.miperumarket.com/mnbvf/rnct.php?arg=Vegetarian+party+food+children
    • http://www.vaqua.biz/home/tasr.php?arg=The+rich+food+plan
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Food+distribution+u+s+a
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Good+cheap+food+san+ramon+ca
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Dold+foods+inc+hormel+foods+corporation
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Diagnostic+food+labs+grand+prarie
    • http://www.vaqua.biz/home/tasr.php?arg=Sea+food+resturants+in+denver
    • http://www.vaqua.biz/home/tasr.php?arg=Celtic+christmas+foods
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Food+storage+year+supply
    • http://www.aadarshtalkingbooks.com/kiuytr/wrtq.php?arg=Signature+gourmet+foods+schaul%27s+order
    • http://indianpharmacynoprescription.com/products/general_health/vasodilan/order/
    • http://www.terracotta-blumentopf.de/digg/bfcr.php?arg=Gluten+free+dog+food+iams
    • http://indianpharmacynoprescription.com/products/eye_care/pilocarpine/order/
    • http://indianpharmacynoprescription.com/products/blood_pressure_heart/triamterene/order/
    • http://indianpharmacynoprescription.com/
    +50 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000bb23.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBB23 264072 bytes
embedded_pdf_script_0003dffd.bin
79ee6eb947e716fb7333c7d0241375f1ae74465dce69e83799fb6960d8f33899		 pdf-embedded-script PDF decompressed stream script payload at offset 0x3DFFD 254149 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.