C6 Messenger Downloader PDF malware analysis — malicious · 7654b44323546701

MALICIOUS

PDF

371.3 KB Created: 2011-04-27 03:04:51 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 1bd2ee1a5e0665e0ec4c3dd8c13cea78 SHA-1: 04d9faa6292145028effbd27d37d26dd9ba7482d SHA-256: 7654b44323546701f771b178cebd0668521a1652460715c1aa009f371cab78ae

92 Risk Score

Malware Insights

C6 Messenger Downloader · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is a PDF file identified as malicious by a machine learning classifier and contains a critical heuristic firing for the CVE-2008-2551 exploit. This exploit is known to download and execute a secondary payload, indicated by the embedded URL pointing to 'system.exe'. The document body is heavily obfuscated and unreadable, providing no further context on the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9685

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000827.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x827	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.