PDF malware analysis — malicious · 6f3baf79c37a8fa6

MALICIOUS

PDF

486.3 KB Created: 2011-06-22 17:42:49 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 9185d211f5d9cec04f7e00d753ed02c3 SHA-1: 255bc201fc29d7dc98b3d1a15a717b372e6a3658 SHA-256: 6f3baf79c37a8fa6f686a6edb1201545abe8bc1320e805474a0d9689955c49f1

92 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF sample contains a critical heuristic firing for CVE_2008_2551, indicating an exploit for a known vulnerability. This exploit is designed to download and execute a secondary payload, as evidenced by the embedded URL pointing to 'system.exe'. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9665

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off00000632.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x632	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.