C6 Messenger Downloader — PDF malware analysis

Static analysis result for SHA-256 6fa181cda04bcf3a…

MALICIOUS

PDF

56.7 KB Created: 2011-06-22 17:09:23 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 789feeb119b61ff26616be44741fcbd4 SHA-1: 70ad8fd3d325678494c17b7c1683db9c2e152393 SHA-256: 6fa181cda04bcf3ae8937ab526caaff41f40a0a3966be12b94cc054400334193
94 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 90%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains a marker indicating the CVE-2008-2551 exploit, which is known to download and execute malicious content. The ML classifier also flagged the file as malicious. The embedded URLs, while mostly benign, are part of the lure or context for the exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6293

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=1225289
    • http://www.farsnews.com/newstext.php?nn=8904230102
    • http://www.presstv.ir/detail.fa.aspx?id=134657&sectionid=351021501
    • http://www.farsnews.com/newstext.php?nn=8904230001
    • http://www.farsnews.com/newstext.php?nn=8904230024
    • http://www.presstv.ir/detail.fa.aspx?id=134617&sectionid=351021504
    • http://www.presstv.ir/detail.fa.aspx?id=134625&sectionid=351021509
    • http://www.presstv.ir/detail.fa.aspx?id=134663&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134626&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134605&sectionid=351021506
    • http://www.presstv.ir/detail.fa.aspx?id=134667&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134612&sectionid=351021503
    • http://www.presstv.ir/detail.fa.aspx?id=134582&sectionid=351021507
    • http://www.farsnews.com/newstext.php?nn=8904220149
    • http://www.irna.ir/View/FullStory/?NewsId=1225289������
    • http://www.farsnews.com/newstext.php?nn=8904230102������
    • http://www.presstv.ir/detail.fa.aspx?id=134657&sectionid=351021501������
    • http://www.farsnews.com/newstext.php?nn=8904230001������������������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134617&sectionid=351021504���������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134625&sectionid=351021509������������������������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134626&sectionid=351021507������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134605&sectionid=351021506���������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134667&sectionid=351021507���������������
    • http://www.presstv.ir/detail.fa.aspx?id=134612&sectionid=351021503���������������������
    • http://www.presstv.ir/detail.fa.aspx?id=134582&sectionid=351021507������������������������
    • http://www.farsnews.com/newstext.php?nn=8904220149������
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000023f5.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x23F5 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.