Malicious PDF — malware analysis report

Static analysis result for SHA-256 82f7c84456e0c394…

MALICIOUS

PDF

239.0 KB Created: 2017-11-27 07:51:27 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: bf24bd9a02e74d796e0168140e3738e3 SHA-1: 3fa6a4ff33b42db147c3074bcd8e49dc24b78201 SHA-256: 82f7c84456e0c394046e7facd71c70dd24f88b227c4ade369e432fb77b8e8180
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded links that point to external websites. The ML classifier and heuristic firings indicate malicious content, likely designed to redirect users to phishing or malware distribution sites. The embedded script, while obfuscated, contains URI entries that are consistent with this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 5

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.lnt.eng.br/armacon.html
    • http://www.multcalc.com.br/calcvigas.html
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000bb4a.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBB4A 264072 bytes
embedded_pdf_script_0003acfa.bin
9c6199f0e31422e224ee140ef89fd07e3f385b717c111c534e50236c4755686d		 pdf-embedded-script PDF decompressed stream script payload at offset 0x3ACFA 244745 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.