Malicious PDF — malware analysis report

Static analysis result for SHA-256 85ecbecab610c8df…

MALICIOUS

PDF

265.8 KB Created: 2005-11-10 15:27:08 +02:00 Authoring application: Acrobat PDFMaker 7.0 for Excel (via Acrobat Distiller 7.0 (Windows))
MD5: aa61ef40b355d58e1b9b8ef7b0876543 SHA-1: 414b834123728093833cfff69ad332272086ad9c SHA-256: 85ecbecab610c8dfebd738ab7495d8a097797b324e7267fbbbff389fcdd229d8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. This script is identified as a generic exploit stage, suggesting it's designed to download and execute further malicious content. The presence of external URIs, specifically http://www.pdfill.com, points to potential download sources. The script's obfuscated nature and the generic recovery of the exploit stage prevent a more specific family attribution.

Machine Learning

  • Nyx PDF Classifier clean score 0.0301

Heuristics 6

  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pdfill.com
    • http://www.pdfill.com)/S/URI
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdfx/1.3/
    • http://www.iec.ch

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js
e614ee892dcc0392b6a0b2729539d8f8ea4e675d3aa7f327554b6b4d07b2973d		 pdf-javascript-stream PDF /JS object 1 at offset 0xF 2617 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
generic_stage_recovery_000.js
93edccdc0f154f809e6be5953c861abdbf6bca61c3710e6d57dfc94324d19e4c		 deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 1 at offset 0xF 2614 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
generic_stage_recovery_001.js
c686dad754a24008e7ecad3d612f22de0c535d87fefe6586bfdceb829fb9bf33		 deobfuscated-js generic stage recovery null-collapse -> marker-bbbbbbbb-to-%u from decompressed stream at 0x7E0F at offset 0x7E0F 1218 bytes
icc_00_off0003980b.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x3980B 3144 bytes
font_00_sfnt_off00007e0f.bin
195a27e670c6e0b8b7dbcf792a887cfa389403d4184d0b2a7c53b6383fc0521a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E0F 21392 bytes
font_01_sfnt_off00009e6b.bin
f65184fc63ce46829852f1227bc0f1b5d4675a3e420d5887c9a5e7c4cddbfbab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E6B 23016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.