Malicious PDF — malware analysis report

Static analysis result for SHA-256 90024269601ba652…

MALICIOUS

PDF

1.39 MB Created: 2011-07-27 14:26:53 -01:00 Authoring application: pisa HTML to PDF <http://www.htmltopdf.org>
MD5: 41b0856e7fe396d8b5030b5d8ef2409c SHA-1: 6b74e1a41aba22ca14bd35c5bbf1fa246fff2326 SHA-256: 90024269601ba6527c16814f23266619a8b191aa02ebd967a270bbf3c58cc3b6
78 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1218 Signed Binary Proxy Execution

The PDF contains embedded JavaScript and uses ASCII85Decode filters, indicating obfuscation. A high-severity heuristic fired for 'SE_LOLBIN_RUN_COMMAND', suggesting the document contains instructions for executing Windows scripting tools like PowerShell or cmd. The presence of an embedded URI to 'http://musescore.org/de' is noted, though it is flagged as confirmed benign. The document body is heavily obfuscated and unreadable, preventing a more detailed analysis of its specific lure.

Heuristics 6

  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.recordare.com/xml.html
    • http://lilypond.org
    • http://www.personalcopy.com/sfarkfonts1.htm
    • http://ocmnet.com/saxguru/timidity.htm#sf2
    • http://www.melodymachine.com/sfark.htm
    • http://www.musescoretips.com/2011/02/how-to-create-triplets-in-musescore-video/
    • http://www.htmltopdf.org
    • http://www.reportlab.com
    • http://musescore.org/de
    • http://www.musescore.org/en/forum/8
    • http://www.youtube.com/watch?v=ugzgezapbge
    • http://de.wikipedia.org/wiki/versetzungszeichen
    • http://de.wikipedia.org
    • http://de.wikipedia.org/wiki/arpeggio
    • http://musescore.org/nb/h\345ndbok/taktart
    • http://www.videolan.org/vlc/
    • http://www.youtube.com/watch?v=kfj7v5s4akw
    • http://de.wikipedia.org/wiki/verzierung_%28musik%29#kurzer_vorschlag
    • http://de.wikipedia.org/wiki/verzierung_%28musik%29#langer_vorschlag
    • http://musescore.org/de/freelinking/gabeln
    • http://musescore.org/sites/musescore.org/files/cchords_muse_1.png
    • http://musescore.org/sites/musescore.org/files/cchords_nrb_1.png
    • http://musescore.org/sites/musescore.org/files/cchords_rb_1.png
    • http://musescore.org/sites/musescore.org/files/cchords_sym_1.png
    • http://musescore.org/sites/musescore.org/files/slur_b2t.png
    • http://en.wikipedia.org/wiki/general_midi
    • http://www.musescore.org/download/fluid-soundfont.tar.gz
    • http://mscore.svn.sourceforge.net/viewvc/mscore/trunk/mscore/share/sound/timgm6mb.sf2
    • http://www.7-zip.org/
    • http://de.wikipedia.org/wiki/triole_%28musik%29#triole
    • http://creativecommons.org/licenses/by/3.0

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_029_off00036a72.bin
9be8e2699ef68cd8c1d87e74dd58fd2086197524d7c645bb1af2f04f768d174e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36A72 617100 bytes
stream_031_off0004ecce.bin
394fc96cbbf9733db35ff52a6785c2f326aa187cd85eef10f8c7375d4f79ca0f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4ECCE 570900 bytes
stream_033_off0006c695.bin
a7070360624a3e0b95e0661a19211ec724a885cc84a8c2c2fa929ed3b678cce9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6C695 580800 bytes
stream_037_off0009f32f.bin
0c9a06c6ab03e09589fd1d1c587f02dec1be63413334cf35d7e597dca0a208d3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9F32F 445500 bytes
stream_061_off000cc2ed.bin
efecb2b9bf945414a2791f2b5ac658469e6f48bdd92acefdce23996cc037b6d3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCC2ED 443418 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.