Malicious PDF — malware analysis report

Static analysis result for SHA-256 73c1980a9504f3aa…

MALICIOUS

PDF

242.5 KB Created: 2012-01-06 16:52:45 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: dd85b1d0695b620519566a921913d9b8 SHA-1: 040c0bda178ad632f88a9117cfc7292f99fc2190 SHA-256: 73c1980a9504f3aa4b92f083f97d30cbe227e747fbaa8affcd8f900a488184ba
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded JavaScript payload and a hidden HTML iframe, both of which are indicative of malicious intent. The embedded script likely attempts to redirect the user to the provided URL, which is designed to appear as a legitimate news article but serves as a lure for malicious activity. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9691

Heuristics 4

  • PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME
    PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gujaal.com/296/tamilnadu-election-results-2011-updates-tn-election-results-li In PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=result&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=government&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=bargain&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=data%20entry&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=home&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=candidate&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=pIn PDF document text
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%2PDF link annotation
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000d477.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc
decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD477 264072 bytes
embedded_pdf_script_0003c637.bin
d8e210518788e3dc3d8f6d8256fdce47a1d88c72fc715a61bce46998ee8c8972
pdf-embedded-script PDF decompressed stream script payload at offset 0x3C637 248262 bytes
Preview script
First 1,000 lines of the extracted script
%PDF-1.5
3 0 obj
<</Type /Page
/Parent 1 0 R
/Resources 2 0 R
/Annots [<</Type /Annot /Subtype /Link /Rect [336.05 733.85 365.39 721.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=result&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p)>>>><</Type /Annot /Subtype /Link /Rect [304.02 523.85 367.38 511.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=government&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p)>>>>]
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 1619>>
stream
x��XKs�6 ��מzñ�� >E��&M2q�N����� M��Z U��b���~ H@��x<�� ���� ������T �'�bi ����|�.�A����-���� �ԧ����q�E�̂� R9+��?�?�N�" ���VH1 ���X�uAw+Q�-����{��aݯ��^� �GήI��C) e��U�N#/6�oDCb:(g%�⁎9 ���[K�)I��M��w�Ď<�K� ����p-E(|� Й/R�  �镐� �� ĕռ��C/	e��^�ɍL��K'�z-�H� �v8��� �^��4��0� ��4vrM����o�z�� �Z�sIr���
�;� ����{� u pl`\ M<?q�k ���~]�ű �^ �+ߛ���\ �(�d^r�  ��O���� �FIW �
��V- �BBE؟ �~�� ��~�YEzk�HѪ�� 6� =��~s r�  ����+`ytu�� �J|իvx��;C�� �sZ�o� �Z�.��yv���Ԋ'g��*$--`�iD�'�=*"����X��\!�A ���� � k Ⱥ�㜬3���
 Y軜 ���ߚ�L� �9�+dU�� ��[��Nm?;�fn!HY�����.�>hm�P
�������0D�{�5��J�(� �5,WD�k�6�ѵΩ[��1�F��Xy�H���xOڽ�w#��NU���wXG��"=K�u�� qR��Z�8��
�`� ��s��챠"}��c�-��-��R�P� K#���.�,�T���UM
YW՗�c� Ļ<�ؠ: B82#�H�� r��ӧ�0�p����CD � Jج�mZ��$� �%��m�M� ��� {��; ����  u�+#U�  �Mͫ�>8 ��� Xk���'��uY!  q� ,��b�� ����o�sT ~�ڸ����-E��k�;� �n y��\�K}�w��K�E rk3�]   Y a����c O-,����Q��Z��IN�h����_�_��f65���(�0 4p�<��^驄Yw��;�|��P<yI
ő��5x|eU�N�.�� ��'�� � 5 �z 0�����9 � �� gPǸέ )!�T.G��Ȯ5_ޏfӞ�TWU� u���ԡv6���^5�صf�3�n�H�� ���&����DvW3�l5� �߶@�O6�1�k�/� ?�� �U�6q�  ֠p�<5� ouo���Q�+G<�-ԭ5� L�.r��-�� ��g�d[8��POO�P� �Kp��q�~�w �g�4�" ;�~� � �b ؃%T?}�ON1���V:� W�a� 	���Ĝsz�  ��� 0a�� �vz~�cwe��|`g�� y, ��ɜ��ܢ����d2�{ ������ ,Y�LXX�W i�R�� �_�ώk����P�� + � ��w]	*� 3J�� ���># ����Ժ� �� { F��-����! 9�;w�{ 	< ���^ �� >̱�
�U�;�B�I$�D�F��Npc  U�/u ��4���L�fȁ;ӵ��D�MN�q� �K0 � �ƚj\�3� ��ZO �� ��ʠ��<�h��Q��.�����J� *DD���;��G߰�ü7�� ��z �ݔ �~�s��v��� g�ϥ�Ȟ�$ꦠ
*����\ ��z�=$s��G�r���
MA �r�>;b��W����ԗ�(�on��0u��� e	�$� s{�A  w{Ů9_۞�x�?��� 
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/Resources 2 0 R
/Annots [<</Type /Annot /Subtype /Link /Rect [490.13 748.85 530.15 736.85] /Border [0 0 0] /A <</S /URI /URI (http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=bargain&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p)>>>><</Type /Annot /Subtype /Link /Rect [341.36 568.85 398.05 556.85] /Border [0 0 0] /A <</S /URI /
... (truncated)