Malicious PDF — malware analysis report

Heuristics 9

• OpenAction trigger high PDF_OPENACTION
  PDF has an /OpenAction that launches, submits, or opens an external target
• Launch action high PDF_LAUNCH
  PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
• Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
  PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
• /Launch action target: cmd\056exe high PDF_LAUNCH_COMMAND
  PDF /Launch action specifies an executable target.
• Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External URI low PDF_URI
  PDF contains an external URL action
• PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
  The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.redteamsecure.com PDF link annotation

  • http://www.redteamsecure.com/labs/all_projectsPDF link annotation
  • http://dradisframework.org/PDF link annotation
  • http://keepnote.org/PDF link annotation
  • http://www.exploit-db/google-dorks/PDF link annotation
  • http://www.googleguide.com/advanced_operators_reference.htmlPDF link annotation
  • http://www.shodanhq.com/help/filtersPDF link annotation
  • http://www.shodanhq.com/helpPDF link annotation
  • http://www.unshredder.com/PDF link annotation
  • https://github.com/trustedsec/socialengineerPDF link annotation
  • http://www.paterva.com/web6/products/download2.phpPDF link annotation
  • http://www.proofpronto.com/gps-tracking-PDF link annotation
  • https://www.spoofcard.com/appsPDF link annotation
  • http://toool.us/PDF link annotation
  • http://acehackware.com/collections/PDF link annotation
  • https://searchwwwPDF link annotation
  • http://mblsportalPDF link annotation
  • http://dialabc.com/sound/detect/PDF link annotation
  • http://www.redteamsecure.com/PDF link annotation
  • http://www.brickhousesecurity.com/PDF link annotation
  • http://facebook.com/redteamsecure/PDF link annotation
  • http://twitter.com/redteamsecure/PDF link annotation
  • http://www.linkedin.com/in/jtalamantes/PDF link annotation
  • http://www.facebook.com/redteamsecurePDF link annotation
  • http://twitter.com/redteamsecurePDF link annotation
  • http://books.google.com/books/PDF link annotation
  • http://money.cnn.com/2013/04/08/technology/security/shodan/PDF link annotation
  • http://www.whois.net/PDF link annotation
  • http://www.intelius.comPDF link annotation
  • http://www.ussearch.comPDF link annotation
  • http://www.peoplefinders.comPDF link annotation
  • http://www.kali.org/downloads/PDF link annotation
  • http://www.rapid7.com/products/metasploit/PDF link annotation
  • http://www.rapid7.com/products/metasploit/metasploit-pro-registration.jspPDF link annotation
  • http://www.newegg.com/Product/Product.aspxPDF link annotation
  • https://www.youtubePDF link annotation
  • http://www.readspeaker.com/voice-demo/PDF link annotation
  • https://www.youtube.com/watchPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.