Malicious PDF / .VIR — malware analysis report

Heuristics 8

• Obfuscated Pidief-style JavaScript loader (stage not decoded) high CVE related PDF_PIDIEF_OBFUSCATED_VERSION_GATED_LOADER
  PDF JavaScript carries a large opaque encoded stage (a letter-delimited numeric character-code array) that is built to be decoded and eval'd, but no exact Adobe Reader CVE could be attributed because the encoding scheme resisted full static decoding. This is the structural fingerprint of the Pidief / multi-CVE exploit-kit loader family — a version-gated obfuscated JavaScript stage with no benign use. Flagged suspicious on its own; an ML/AV signal or a recovered heap-spray pushes it to malicious.
• JPXDecode + active content — JPEG2000 CVE-family indicator info CVE related PDF_JPX_CVE_2018_4990_RELATED
  PDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Unusually high stream count medium PDF_MANY_STREAMS
  PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
• ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
  ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://app.e-builder.net In PDF document text

  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
  • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/illustrator/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
  • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
  • http://ns.adobe.com/xap/1.0/g/In PDF document text
  • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_16_sfnt_off001e8b2f.bin)
  • http://www.microsoft.com/TypographyIn extracted file (font_16_sfnt_off001e8b2f.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.