PDF / .TMP malware analysis — malicious · 898cb82da84a531d

MALICIOUS

PDF / .TMP

237.6 KB Created: 2010-04-23 16:54:43 +08:00 Authoring application: Adobe Designer 7.0

MD5: b1a1f12b1089019876fdaa9715a194f1 SHA-1: f838994a10c99611035a356f2d9fcdc591a0e53f SHA-256: 898cb82da84a531dc3bbc0e0bf567d2937d44730c13f4824ccc90c3445f5760d

238 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

This PDF file contains multiple indicators of malicious activity, including embedded JavaScript streams and an embedded secondary PDF. The ClamAV detection 'Pdf.Exploit.Agent-35646' strongly suggests exploitation of a known PDF vulnerability. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, as indicated by the presence of embedded files and the 'POLYGLOT_CHILD_PDF_STATIC_TRIAGE' heuristic. The file's structure and embedded content point towards a common PDF-based exploit delivery mechanism.

Heuristics 13

ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Additional-actions dictionary low PDF_AA

PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0033.bin` `c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb`	pdf-embedded-file	PDF EmbeddedFile object 33 at offset 0x74E9	85 bytes
`embedded_file_obj0034.bin` `c3e1960ce8b7916804612ba3ca5a7383bd8329a68775ea4b0663e450b46fc6c3`	pdf-embedded-file	PDF EmbeddedFile object 34 at offset 0x759B	1675 bytes
`embedded_file_obj0036.bin` `ed762fbdece2f28698a9b616738dad71743a6f16ae241aac314fe0a6ffbde9b6`	pdf-embedded-file	PDF EmbeddedFile object 36 at offset 0xA0A5	11668 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`embedded_file_obj0037.bin` `9de85e34edf3e917e689a8038021a103f1a74681300a3e2b9c5fc0f1e5334c45`	pdf-embedded-file	PDF EmbeddedFile object 37 at offset 0xA2BE	2228 bytes
`embedded_file_obj0038.bin` `57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f`	pdf-embedded-file	PDF EmbeddedFile object 38 at offset 0xA579	212 bytes
`javascript_obj0025_000.js` `4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb`	pdf-javascript-stream	PDF /JS object 25 at offset 0x6D72	870 bytes
`javascript_obj0027_001.js` `4e139c8b22ec16bd5aa51575c80dec2bbf89b76977a06b68473031a0eb206366`	pdf-javascript-stream	PDF /JS object 27 at offset 0x6EF6	2794 bytes
`javascript_obj0029_002.js` `c876171bd867b66b7671fb337ff9e57d18cd15b43d344cf5a7243821300a408a`	pdf-javascript-stream	PDF /JS object 29 at offset 0x71E5	1528 bytes
`font_00_cff_off00001217.bin` `23831e143e2e1a484b95ee765b15d94562c951468b895c080e655667dc04ddf0`	pdf-font-stream	PDF embedded font (cff) at offset 0x1217	31178 bytes
`polyglot_child_pdf_off00038f5f.pdf` `f840b4d92699c04296263b52305ac3b259495285725745011549b1dc1cb64250`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x38F5F	9993 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.