Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e6608569c5de418…

MALICIOUS

PDF

590.7 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 983958e67dadacd2194d640d797b9d12 SHA-1: 15a961bd1465af5a8ae57f199c5f05ea880cef56 SHA-256: 7e6608569c5de41891625b9b02840c2d574fda89b6cd5cafc23550a9a300c6b1
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file that contains embedded PDF files and exhibits suspicious static findings, including remote GoTo actions. The ML classifier also flagged it as malicious. These indicators suggest the document is designed to lure the user into opening embedded content or navigating to external resources, likely for malicious purposes such as downloading further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
magellanic_neptune_662.pdf
d45d7721c6f4f8f068c12cba7a10cc50fa9a3bbffc76c043f332d8ae551adc46		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FD 262573 bytes
magellanic_neptune_662_1.pdf
00d4e1e74802ebffb3bcd09a379c6cbc44df058078015231a3d901a0bfa22443		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FD 348886 bytes
magellanic_neptune_662_2.pdf
618163550057ffeef83a744fa32a1ac5cff6245f45ab2dc6514ba6c3e4ff39f0		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FD 435422 bytes
objstm_0121_00.bin
a6442073c4e2092d3a20847f34a8ea515c2f0c173e20489acbdf431736e0e3e0		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1133 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.