Win.Trojan.Ramnit PDF malware analysis — malicious · 6ef3dff06c68a24e

MALICIOUS

PDF

111.4 KB

MD5: 468c126491408785c0a6144182fc525c SHA-1: dc6099b507563663c81810daab8c9ee66601c0fe SHA-256: 6ef3dff06c68a24e38f10d474477893a2603b0366b116c56bda1572ad9bb87f3

210 Risk Score

Malware Insights

Win.Trojan.Ramnit · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded VBScript that reconstructs and executes a PE payload named 'svchost.exe'. This behavior is indicative of a dropper mechanism, and the extracted artifact was identified as Win.Trojan.Ramnit by ClamAV. The embedded script is responsible for the execution of the malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

VBScript in PDF stream reconstructs and runs a PE payload critical PDF_VBS_HEX_PE_DROPPER

PDF stream contains an HTML/VBScript block that decodes a long hex string into a Windows executable and runs it via WScript.Shell. This is an embedded dropper payload, not ordinary PDF JavaScript.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_vbs_dropper_000003e9.vbs` `50b36b292c4a29f5f0d9642bb1487d597e7f817cb538628ff0d791b00e4fac65`	pdf-embedded-script	PDF raw bytes VBScript dropper at offset 0x3E9	113122 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s).
`svchost.exe` `fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320`	embedded-pe	Decoded PE from PDF VBScript dropper at offset 0x3E9	56320 bytes
Detection ClamAV: Win.Trojan.Ramnit-9775455-0 Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.