Malicious PDF — malware analysis report

Static analysis result for SHA-256 812e8bf712d9a94e…

MALICIOUS

PDF

590.8 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: e363d6ec9703982b3db9a72a6d6e3ac0 SHA-1: e3bde2818fc45d6f96b884f4d252d23139e9ea26 SHA-256: 812e8bf712d9a94e52245e61afd5fb2b9e3453825eee9306208973d99d76b573
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file exhibits suspicious characteristics, including embedded files and remote GoTo actions, as indicated by the PDF_EMBEDDED_CHILD_STATIC_TRIAGE and PDF_GOTO_REMOTE heuristics. The ML classifier also flagged it as malicious. While no specific document body content or scripts were provided for direct analysis of user-facing lures, the presence of embedded PDFs suggests a multi-stage delivery mechanism. The benign URLs listed are likely standard PDF metadata and do not contribute to malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cigar_mercury_480.pdf
3973f5a7fc0dfa16002951a108b765fde38c19af39ce0f7c29c3664977882e18		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 262643 bytes
cigar_mercury_480_1.pdf
efff4f98a1deeba9a07d0696a28f99ec7736b1b6ea5d961365057556bc94ed71		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 349032 bytes
cigar_mercury_480_2.pdf
680961223626542b7b26a959dc077ab4baff075b99d03f94d29c1655fdcedb7b		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 435555 bytes
stream_019_off0001a020.bin
83a957becf00e7a2b3d1532a6a1ec232e2fa30b1f56fdfc96114a91f9b7715f2		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A020 522121 bytes
objstm_0121_00.bin
49ee6dfec4df71ff29b534939f9ce8817e52a8fbe9f5a3ca5ed5350dd4fbfca4		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.