PDF malware analysis — malicious · 8e13f02686cc7e13

MALICIOUS

PDF

76.4 KB Created: 2017-11-23 10:29:50 +09:00 Authoring application: Aspose Ltd. (via Aspose.Pdf for .NET 17.4.0)

MD5: 7f21cfc4244f9d1cca8a35afbd8aae02 SHA-1: 7aa3c50d7337c2977aaaa7f0240ef6b27c2e65ab SHA-256: 8e13f02686cc7e13e4ac07ad0ddb13361e9ade5ad23078c045e85874b9e65dd9

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell

The PDF file contains a launch action that executes cmd.exe with specific parameters. This command attempts to change the directory to the user's home path and then checks for the existence of a file named ".pdf" on the Desktop. This behavior is indicative of a dropper or exploit attempting to prepare the environment for further malicious activity. The ClamAV detection also confirms its malicious nature.

Machine Learning

Nyx PDF Classifier clean score 0.0128

Heuristics 4

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&\(if exist "Desktop\\.pdf" \(cd "Desktop"\' — references a known-dangerous executable (cmd, PowerShell, etc.).
ClamAV: Pdf.Dropper.Agent-7281577-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7281577-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.w3.org/1999/02/22-rdf-syntax-ns#

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`icc_00_off00000429.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x429	3144 bytes
`font_00_sfnt_off00001228.bin` `e4e93aa9737e49a14e9e064e01eb6602abc9eaedb120372a02c1f4a3e49dc781`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1228	44576 bytes
`font_01_sfnt_off000082af.bin` `8f6e9b53389f026d4980b1a1a26f28892fdb0089cdbaee977efdc92828c6443d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x82AF	25172 bytes
`font_02_sfnt_off0000ec0d.bin` `c323257ecce59612d975fbae6b2fc9ea30b18adccb9fc84ffd0895fd9505e122`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC0D	18844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.