Malicious PDF — malware analysis report

Static analysis result for SHA-256 7aedba45e0fb7dc0…

MALICIOUS

PDF

54.5 KB Created: 2011-04-16 14:19:44 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 1ae5e7270954257345070222cab2a010 SHA-1: bc7875192339f70986b80b2b560768691ac8fb8c SHA-256: 7aedba45e0fb7dc0dcfd8a5b0e874a2c743330d8e427e6b89abc78ae3f97fe2c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The PDF file contains a heuristic match for the CVE-2008-2551 C6 Messenger DownloaderActiveX exploit. This exploit is designed to download and execute a secondary payload from a specified URL. The presence of the 'DownloaderActiveX.cab' URL and another executable URL ('system.exe') strongly suggests this malicious intent. The exploit likely facilitates the download and execution of the 'system.exe' file.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://quqnoos.com/index.php?option=com_content&task=view&id=2364&Itemid=52&lang=farsi
    • http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=872572
    • http://www.mehrnews.com/fa/newsdetail.aspx?NewsID=1009565
    • http://www.irna.ir/View/FullStory/?NewsId=872726
    • http://www.irna.ir/View/FullStory/?NewsId=865488
    • http://www.presstv.com/Persian.aspx?id=6836
    • http://www.presstv.com/detail.aspx?id=115049&sectionid=351020202
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00001bcd.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BCD 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.