PDF malware analysis — malicious · 84f4aa57e5e8d7c2

MALICIOUS

PDF

2.4 KB

MD5: b088e526bab9285f0c7a548a628adaba SHA-1: 69d451105875d94a1855fce565ab72a3be492f24 SHA-256: 84f4aa57e5e8d7c25f4414b26864f509b7a2316ec1cdce1a3a3cc1968a94333b

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a launch action that executes cmd.exe. This command is designed to download and execute a payload from the embedded URL http://xin.w2c.ru/kit/?m=1. The embedded script payload further supports the malicious intent of this document.

Heuristics 4

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters ' /c echo Set qndhmjqnzazberptepvb = CreateObject\("MSXML2.ServerXMLHTTP"\' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://xin.w2c.ru/kit/?m=1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_000002d5.bin` `abb28387e885d8dd3a952b3d174e0c7461130d0be8491814dcb57439b918cbb8`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x2D5	705 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.