PDF malware analysis — malicious · 723f10bc60048166

MALICIOUS

PDF

888.2 KB Created: 2011-04-22 21:56:30 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: e6cc1bfb16a3b026ee5a458045667ec9 SHA-1: 9a5cb876e99cce24a4cf751c8ec02381153ca8da SHA-256: 723f10bc6004816603f2e1b3b0942fceaacef765bc79c7999119cb58e4903ec4

92 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF contains a critical heuristic firing for CVE-2008-2551, indicating an exploit for a known vulnerability. This exploit likely facilitates the download of a secondary payload, as evidenced by the embedded URL pointing to 'system.exe'. The ML classifier also flagged the PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9396

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000069c.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x69C	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.