PDF malware analysis — malicious · 880c177bc96af921

MALICIOUS

PDF

283.8 KB Created: 2010-02-07 22:10:13 +01:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx (0.6))

MD5: c28f5fe70d5025bc452bedcd3023f961 SHA-1: 395289569ef36fdcbb249d8e731af831037b5a5d SHA-256: 880c177bc96af9212966216c337ec7e92a7f6459b9c22b0e7110aa4e9ee3e0e0

342 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF contains a critical PDF_LAUNCH heuristic firing, indicating a launch action targeting cmd.exe. This action is combined with parser-evasion techniques and an embedded script payload, strongly suggesting an exploit attempt. The script itself, though truncated, appears to be constructing a VBScript file to download and execute further content from the URL http://www.foo.be/. The ClamAV detection of Pdf.Exploit.Agent-36197 further corroborates the malicious nature of this file.

Heuristics 9

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
ClamAV: Pdf.Exploit.Agent-36197 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36197
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION

PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.foo.be/
- http://www.gitorious.org/~adulau

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0000ddec.bin` `b8f1a565d4337ddc2a1cadf2b06cd39d082e238cab251c88e69a5391e7131c08`	pdf-embedded-script	PDF decompressed stream script payload at offset 0xDDEC	290653 bytes
Detection ClamAV: Pdf.Exploit.Agent-36197 Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 2 long base64-like blob(s).
`font_00_cff_off00003d87.bin` `09e18e495b68106a55aace3f441183e73b28de0f6fbcb0af0b76d08e38de00da`	pdf-font-stream	PDF embedded font (cff) at offset 0x3D87	15636 bytes
`font_01_sfnt_off00007383.bin` `1bbf8d898c7de34b2ed1bfb68d2725a06e3c5e09957aee601794b4fe88adb9f4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7383	13054 bytes
`font_02_cff_off00009b0a.bin` `81cd2ec160f0dbbfecf3a7282aa50fb69c8be6a3e42aa5a6d27c573cc7517a2e`	pdf-font-stream	PDF embedded font (cff) at offset 0x9B0A	7529 bytes
`font_03_cff_off0000b8d6.bin` `19f70b70255abac1a93513d95c8ae661c9f9d2f99400a22c24727869e919e5ad`	pdf-font-stream	PDF embedded font (cff) at offset 0xB8D6	7369 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.