PDF malware analysis — malicious · 8bb8c94d48c2c02e

MALICIOUS

PDF

551.4 KB Created: 2011-05-17 09:06:43 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: 9bda856f05c7e384ff6fcaa9144dca1e SHA-1: bab025914b9ee70f1f0e91a2afc1aacb3f99637f SHA-256: 8bb8c94d48c2c02e9451e960698115cc6820f654239a546ae149cd823e4270c4

76 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded JavaScript and triggers a critical heuristic for the CVE-2008-2551 exploit, commonly used for downloading secondary payloads. The embedded URL 'http://artisanballoonz.com/system/system.exe' is highly suspicious and likely serves as the download location for the malicious payload. The presence of optional content groups with action triggers further suggests an attempt to execute code upon opening.

Heuristics 4

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off00000b4a.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB4A	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.