Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c290ddec759a089…

MALICIOUS

PDF

9.89 MB Created: 320p364350`%_313$\W377 200 Authoring application: 9272006202370:lI214e.027257X321035013027257C (via 9272006202370u5001217a035X342022302J;T272{2605360}363271h355)
MD5: e005275e07cef2ad46dfdcdb2dda5db2 SHA-1: 3add1ea80d94b293b26c5ba42351a7f87a9b8663 SHA-256: 7c290ddec759a0890592cd0bc12dcc95f815e9d503d1057a3670a0a743c3fb94
232 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF document exhibits characteristics of an advance-fee scam, aiming to trick users with promises of prizes or funds contingent on parcel delivery. The presence of encrypted JavaScript and a UNC path suggests an attempt to hide malicious code and potentially steal credentials, aligning with common tactics for financial fraud and credential harvesting. The ML classifier strongly indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9685

Heuristics 7

  • UNC path in PDF — possible NTLM credential theft (CVE-2018-4993/CVE-2019-7089) high CVE likely CVE_2018_4993
    PDF contains a UNC path (\\server\share) alongside action triggers — when a vulnerable viewer resolves this path, Windows may send NTLM credentials to the remote host as the matching PDF action is processed
  • Encrypted PDF carries /Js — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/Js). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.peterszor.com
    • http://necsi.org:16080/postdocs/sayama/sdrs/java
    • http://www.foresight.org/nanorev/ecophagy.html
    • http://www.bitstorm.org/gameoflife
    • http://fourmillab.ch/documents/univac/pervade.html
    • http://www.skrenta.com
    • http://www.viruslist.com
    • http://www.virusbtn.com/resources/viruses/indepth/beagle.xml
    • http://viruslist.com/eng/viruslist.html?id=2836
    • http://www.x86.org/secrets/opcodes/salc.htm
    • http://www.virusbtn.com/old/OtherPapers/MSAV/
    • http://lslwww.epfl.ch/biowall/index.html
    • http://fourmilab.ch/documents/univac/animal.html
    • http://www.f-secure.com/v-descs/mquito.shtml
    • http://www.cs.uu.nl/people/markov/gmaker/doc.html
    • http://www.research.ibm.com/antivirus/timeline.htm
    • http://www.intel.com/design/PentiumIII/specupdt/24445349.pdf
    • http://www.computer.org/security/v1n5/j5cap.htm
    • http://cm.bell-labs.com/who/ken/trust.html
    • http://www.f-secure.com/v-descs/3apa3a.shtml
    • http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_021_off0001bb59.bin
dd64b89e379b78ad7d6c94feee630f40f21a3fdf03ed80a155b055784d5dbd17		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BB59 6339 bytes
stream_048_off0002779e.bin
a20c266f32f53a303ed7147038339f8f9249f1d3ca28b12141ddb220c5da539c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2779E 19188 bytes
stream_065_off0002e536.bin
e1f8ed504a2b6e0ea372e93b27010b80978bb78430bc6e399654a01c8eae549e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E536 4950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.