PDF malware analysis — malicious · 8f38cc544b0a862b

MALICIOUS

PDF

806 B

MD5: 5d9b7b949aada051af792faf14199e80 SHA-1: b7c0c040895f68127d8138c7a0d54dd85d894444 SHA-256: 8f38cc544b0a862bfd297e8bd6fb1aa1ff52890bcb9445aaab24dc5ca91a0084

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1204.002 Malicious File

The PDF file contains a launch action that executes cmd.exe. This command attempts to write a VBScript to disk and then execute it. The VBScript is constructed using string concatenation, making it difficult to fully deobfuscate from static analysis alone, but it is designed to download and execute a second-stage payload from the URL http://www.lichon.net/BUILD.B/tmp/m.vbs. The embedded script payload heuristic further confirms the presence of malicious script content.

Heuristics 4

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
/Launch action target: cmd high PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo B="m.vbs":With CreateObject(StrReverse("PTTHLMX.2LMXSM"'.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.lichon.net/BUILD.B/tmp/m.vbs

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0000006f.bin` `ad55c8e83a5896a04b2012c676820daeab2b84cc539e444c6366e79f55a571c5`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x6F	63 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.