Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e9eb0684234f0e7…

MALICIOUS

PDF

53.4 KB Created: 2011-05-17 09:08:06 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 67d14792717c0b0ef072b44e6fac00db SHA-1: fabcb859df1fd3849a5939c311bdf15761f8b1aa SHA-256: 8e9eb0684234f0e7499b462be89dbdfe1830e6e4f61a5361d4ec809c37d07ef1
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The sample is a PDF document that exploits the CVE-2008-2551 vulnerability, indicated by the 'C6 Messenger DownloaderActiveX exploit' heuristic. This exploit is designed to download and execute a payload from a remote URL. The embedded URL 'http://artisanballoonz.com/system/system.exe' is highly suspicious and likely serves as the download location for the malicious payload. The presence of the ActiveX CAB file also suggests an attempt to leverage browser or application vulnerabilities.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=893788
    • http://www.irna.ir/View/FullStory/?NewsId=893869
    • http://www.mehrnews.com/fa/newsdetail.aspx?NewsID=1016245
    • http://www.presstv.com/Persian.aspx?id=7105
    • http://www.irna.ir/View/FullStory/?NewsId=893915
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00001717.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1717 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.