PDF malware analysis — malicious · 7d8a6ad1eece02f8

MALICIOUS

PDF

242.5 KB Created: 2012-04-03 07:34:17 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: 9c04f1d413e8aa25091a03c5180feb9f SHA-1: 1387b2e0aa8feb4243e26f8c7a5dd7f757b4d963 SHA-256: 7d8a6ad1eece02f80375c45ae3f8802bbb758d35c1b2b6d26a7a6d59c0ea0d59

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1204.002 Malicious File

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_EMBEDDED_SCRIPT_PAYLOAD heuristics. The ML classifier also flagged it as malicious with high confidence. The embedded URL, while marked as benign, suggests a potential redirection or tracking mechanism. The primary attack vector appears to be the execution of malicious JavaScript within the PDF, likely to download and execute a further payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9691

Heuristics 4

Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=result&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=government&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=bargain&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=data%20entry&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=home&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p
- http://it.ph.affinity.com/ctrack0.php?&cmpubid=xvj35&cmskps=&cmsite=www.gujaal.com&cmchannelid=&cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&cmoe=yahoo&cmoq=tamilnadu%20live%20news%20aiadmk&cmvd=1600900-3301361&cmvc=null&cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&rnd=1305270576026&q=candidate&at=XS&cmip=17&cmis=149&cmid=6&cmdt=p

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0000d477.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xD477	264072 bytes
`embedded_pdf_script_0003c637.bin` `3cbc9def5b671f6d2b2e54e487263f7f3891e77e8ccec84c0542a026e876e451`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x3C637	248262 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.