Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ee97f53d3bfad4b…

MALICIOUS

PDF

88.9 KB Created: 2011-09-20 10:38:42 +08:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Acrobat Distiller 8.1.0 (Windows))
MD5: 6ed65a80a9feb84894405979d9606928 SHA-1: 3085fd0367273e3dfe2a6d6b5130d8fece662b84 SHA-256: 6ee97f53d3bfad4bf6f23710b62fa5b690f52af5206854b6bece3221ae64f80a
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file exhibits critical heuristic firings related to JavaScript exploits and XFA forms, strongly indicating it's designed to execute malicious code. The presence of embedded files and a suspicious URL suggests it acts as a downloader for a secondary stage. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 10

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.8/
    • http://www.xfa.org/schema/xfa-template/2.8/
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.xfa.org/schema/xfa-locale-set/2.7/
    • http://ns.adobe.com/xtd/
    • http://www.xfa.org/schema/xfa-form/2.8/
    • http://cgi.adobe.com/special/acrobat/update

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
3000b3469a8bd553f177da3f507a5ea2271a3dee1fd5d5343f41950837af583c		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x3B36 163 bytes
embedded_file_obj0002.bin
66b82b096ae83103365f40b9b767a5582b0a497e4589e7b9323eac0320c61808		 pdf-embedded-file PDF EmbeddedFile object 2 at offset 0x3C27 1670 bytes
embedded_file_obj0003.bin
e763ac63c3d21786709e7f462b463575525d0e344202f42dbb96897a01541e78		 pdf-embedded-file PDF EmbeddedFile object 3 at offset 0x3F43 785 bytes
embedded_file_obj0004.bin
720c47f19e6a058099295d18a16b7149cc73fe497eb78821ea810f3192228dc4		 pdf-embedded-file PDF EmbeddedFile object 4 at offset 0x4138 150 bytes
embedded_file_obj0005.bin
c8a82f67dfd8d68c2f8fe494ca2deee4604701c8f02863bf87d222b992e45de9		 pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x4209 2955 bytes
embedded_file_obj0006.bin
4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5		 pdf-embedded-file PDF EmbeddedFile object 6 at offset 0x4583 200 bytes
embedded_file_obj0007.bin
4273cd319df227c91b92e5509527bb4f6e1abfb3aa2beec2fb2adb93a8671f62		 pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x4676 835 bytes
embedded_file_obj0008.bin
4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x484D 56 bytes
stream_002_off000003ed.js
529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3ED 1363 bytes
stream_003_off000005ca.js
e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5CA 902 bytes
objstm_0047_00.bin
856830b101f28eaa61f2ccb44204fecaa2d0a9658055009fda363a9d3056ff76		 pdf-objstm-decoded PDF /ObjStm 47 0 obj (inflated) 2543 bytes
polyglot_child_pdf_off0000f487.pdf
d68e82af91f9a9445f095caf2ed01c46a5e0bf63af4afd57a030ebe31d2346db		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0xF487 28411 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
polyglot_child_pdf_off00014b93.pdf
9a95102ad6b4d58a9a742832f61490a27e9b62855fe295b13214addfda321ad3		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x14B93 6127 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.