Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e193fd45b270df3…

MALICIOUS

PDF

558.4 KB Created: 2007-08-08 11:31:59 +01:00
MD5: 956fa0f15a2e207dd266fea0cd67efc0 SHA-1: e64e758290513eff7e7ba2d203e0cc90dc4fc220 SHA-256: 8e193fd45b270df300aec745f613fc0f862f6e546c28169c4c0b4cbfd69e0f62
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded JavaScript streams, with a high-severity heuristic firing for PDF_EVAL indicating the use of eval(). This suggests the script is designed to execute arbitrary code, likely to download and run a malicious payload from one of the embedded URLs. The presence of multiple unknown reputation URLs further supports this. No specific family could be identified.

Heuristics 6

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.healthed.org.uk
    • http://www.lifeskillstraining.com
    • http://www.dare.com
    • http://www.prponline.net/products.htm
    • http://www.med.cornell.edu/research/gjbotvin/index.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0245_000.js
87b473ce70c9228c80c80935ff6724a7a159c26f0d27bed1676f18ea1f6de784		 pdf-javascript-stream PDF /JS object 245 at offset 0x197D 138 bytes
javascript_obj0365_001.js
b9122b4565950ac192ee1052575e439b51edce2b995128e9d1237602e6f82807		 pdf-javascript-stream PDF /JS object 365 at offset 0x196F7 34 bytes
javascript_obj0366_002.js
52011416a458c8279d38f8cf1c17ce225d4c5fdf444265e34e3abb588280acfb		 pdf-javascript-stream PDF /JS object 366 at offset 0x19741 35 bytes
javascript_obj0372_003.js
d329fc89f18b6cb97d018e3ae694eeb99a19378532ad120d658ed85d7c2ade87		 pdf-javascript-stream PDF /JS object 372 at offset 0x1A0C8 213 bytes
javascript_obj0393_007.js
19057f9f222d49fdca3560b5c97e17d32cdc47ba686d03bea00fb381aac62c17		 pdf-javascript-stream PDF /JS object 393 at offset 0x1B584 33 bytes
javascript_obj0394_008.js
1c84c437503e05ac5400760fdae3efa7ef1e1f4bca451dbe031a6deb63310391		 pdf-javascript-stream PDF /JS object 394 at offset 0x1B5CD 34 bytes
javascript_obj0412_011.js
be9dbaad4f8bf54e6e48772ddd2e9f3a9c8a698a5c89247392b1480282644f2f		 pdf-javascript-stream PDF /JS object 412 at offset 0x1BC33 49 bytes
javascript_obj0070_013.js
a22056b863e33d5b6fb5ce09eb179a17a4252164b54686b25e3ef87046a99e59		 pdf-javascript-stream PDF /JS object 70 at offset 0x83290 57 bytes
javascript_obj0078_014.js
2deb1eeced34cadb865abfba82a2d5a878f556bcde83204a3ab8741ef00717e1		 pdf-javascript-stream PDF /JS object 78 at offset 0x8343E 79 bytes
javascript_obj0089_015.js
2246712cff2907365655d43c0c35a0c3210eaae6b01edcf4925342e3d41ce3fb		 pdf-javascript-stream PDF /JS object 89 at offset 0x838DD 43 bytes
javascript_obj0189_017.js
99cab6647e4abe0d183a78cbb0bad1426284c399bb0c254385ffdaf93b24861a		 pdf-javascript-stream PDF /JS object 189 at offset 0x876C0 35 bytes
javascript_obj0200_018.js
34ca4b59bac4e3c624c92eb2ef3de4145c4f54006c37211a02cd492e9f2b97d0		 pdf-javascript-stream PDF /JS object 200 at offset 0x87EAB 60 bytes
javascript_obj0110_019.js
a8bad18c60dfe59070a15b916f249f9ab97c5ccc66c95cdad04ed324806c01d4		 pdf-javascript-stream PDF /JS object 110 at offset 0x8462C 309 bytes
javascript_obj0118_020.js
e4cfaf9da50100ae5ebccb159120cb247c0803ea156f414cfe85f224a7bf14a3		 pdf-javascript-stream PDF /JS object 118 at offset 0x84DB8 953 bytes
javascript_obj0138_021.js
e948a59443210f697fb3ba9d8ffb4edf016a83d3ff84326bd407c4c310720cc0		 pdf-javascript-stream PDF /JS object 138 at offset 0x85CF4 296 bytes
javascript_obj0188_022.js
baded2452d1dc660cf16c2a6c05cb37e160b2810e323936bf8eca7f51d1e8bbd		 pdf-javascript-stream PDF /JS object 188 at offset 0x8741A 912 bytes
javascript_obj0195_023.js
9c4666ae7de414adf46e8a0e00d75ef1f351fef99f5f908c847fb0443b878db4		 pdf-javascript-stream PDF /JS object 195 at offset 0x87848 911 bytes
javascript_obj0198_024.js
b0382902ec707e797b6ce57b31031156f2bab58b26a98db499d731cc6944427f		 pdf-javascript-stream PDF /JS object 198 at offset 0x87B82 1070 bytes
javascript_obj0235_025.js
488d146717b23eb8004388e72a398c124cd079d65dfc76df7d2380bb827ae223		 pdf-javascript-stream PDF /JS object 235 at offset 0x8A300 565 bytes
javascript_obj0251_026.js
cc16282145342c0e1f784f0627394047c25eef04d7842365caed1ed47db564d5		 pdf-javascript-stream PDF /JS object 251 at offset 0x1B21 2682 bytes
javascript_obj0252_027.js
81f88f6b03fe1fe2f881a64ef49e611356cb808b42b622141a6baaf993563cf8		 pdf-javascript-stream PDF /JS object 252 at offset 0x1EE7 1294 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
javascript_obj0253_028.js
19850ebca5dbcb0c1d8241dd98da17f45d6a763064cdc7e0749ed5f82791d146		 pdf-javascript-stream PDF /JS object 253 at offset 0x20DE 887 bytes
javascript_obj0254_029.js
a865612ba97d470c1089ff395be945267ed5ec8519a3da6c793287f5f9a3c5c7		 pdf-javascript-stream PDF /JS object 254 at offset 0x22B0 2656 bytes
javascript_obj0255_030.js
d6853af31849da13d6009d33f31ab7b5472479f20c448e59d9db4674f547a0e6		 pdf-javascript-stream PDF /JS object 255 at offset 0x277D 1222 bytes
javascript_obj0256_031.js
4937fa5476556b4c1144187ddc04215eae3f34b968eb6d0dd865964cd6d52ff9		 pdf-javascript-stream PDF /JS object 256 at offset 0x2A18 679 bytes
javascript_obj0257_032.js
02d9178bd7671257cb8cc1c0f548dc8084d01b30396171198b62b443396e417e		 pdf-javascript-stream PDF /JS object 257 at offset 0x2BC1 1633 bytes
javascript_obj0258_033.js
a0021eba2d9841d837ba9ca37bba2fb1b0a490ebaa153a2bf6346a7105151d3d		 pdf-javascript-stream PDF /JS object 258 at offset 0x2E63 738 bytes
javascript_obj0367_034.js
4ad335e0abdcf7a6376858822f6270a8ef3245dae606b935127fa9a572de63a5		 pdf-javascript-stream PDF /JS object 367 at offset 0x1978C 2310 bytes
javascript_obj0371_035.js
7b0efacfcfc8974d5ae053c852e07b0ffbfddd622e7e6e662bc03586adc6918f		 pdf-javascript-stream PDF /JS object 371 at offset 0x19C28 2777 bytes
javascript_obj0387_036.js
865c47a2b6b35d621d60cdcb7935193d7a8010ce13969834ee72d770df732c9d		 pdf-javascript-stream PDF /JS object 387 at offset 0x1AA77 4076 bytes
javascript_obj0391_037.js
2f8899588c5a5bfb0f2011ae4e0dd40527a95fd32e9233164291bbe8487744ea		 pdf-javascript-stream PDF /JS object 391 at offset 0x1B2B5 401 bytes
javascript_obj0407_038.js
b445c2b2ce67d5ff7a8e5d4a68ba90f80459b4a9508e1b7e3201ea4e3507f805		 pdf-javascript-stream PDF /JS object 407 at offset 0x1B92C 303 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.