Malicious PDF — malware analysis report

Static analysis result for SHA-256 90c9023a7e4c903d…

MALICIOUS

PDF

242.5 KB Created: 2012-10-11 08:51:40 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: a50c7fc3d0a4e81aef2aed054e4febb0 SHA-1: 73896df58a3f6a5f893b4cd2bb556250bda17333 SHA-256: 90c9023a7e4c903d8d2c8bca3a715d45aa2954c48cf13b1d55b7be106489b356
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_EMBEDDED_SCRIPT_PAYLOAD heuristics. The ML classifier also flagged this PDF as malicious with a high score. The embedded JavaScript is likely designed to exploit a vulnerability within the PDF reader to download and execute a secondary payload. The presence of an external URI, although marked as benign, suggests a potential command and control or download infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9691

Heuristics 4

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=result&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=government&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=bargain&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=data%20entry&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=home&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p
    • http://it.ph.affinity.com/ctrack0.php?&amp;cmpubid=xvj35&amp;cmskps=&amp;cmsite=www.gujaal.com&amp;cmchannelid=&amp;cmurl=http%3A%2F%2Fwww.gujaal.com%2F296%2Ftamilnadu-election-results-2011-updates-tn-election-results-live&amp;cmref=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Fp%3Dtamilnadu%2Blive%2Bnews%2Baiadmk%26ei%3DUTF-8%26fr%3Dmoz35&amp;cmoe=yahoo&amp;cmoq=tamilnadu%20live%20news%20aiadmk&amp;cmvd=1600900-3301361&amp;cmvc=null&amp;cmtitle=Tamilnadu%20Election%20Results%202011%20%7C%20Updates%20TN%20Election%20Results%20Live%20%7C%20Gujaal%20News&amp;rnd=1305270576026&amp;q=candidate&amp;at=XS&amp;cmip=17&amp;cmis=149&amp;cmid=6&amp;cmdt=p

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000d477.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD477 264072 bytes
embedded_pdf_script_0003c637.bin
e04a37c24be59808278be9ae85f562575f845d6e40f76ba16f04df988e9614f6		 pdf-embedded-script PDF decompressed stream script payload at offset 0x3C637 248262 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.