Malicious PDF — malware analysis report

Static analysis result for SHA-256 91389d1dee5db330…

MALICIOUS

PDF

245.3 KB Created: 2010-06-09 18:40:28 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: ebb04f2cf8ea185eb16f3350a1e798c7 SHA-1: faa00d3bf0d84745783e2f6a53b93b5a841da36a SHA-256: 91389d1dee5db33097bcbde952b839241615157daa1e70cc483cc9319ab0deb7
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF contains embedded JavaScript with multiple obfuscation techniques, including `unescape()` and `eval()` calls, indicating malicious intent. The ML classifier strongly flagged this PDF as malicious. The embedded script payload is likely designed to download and execute a second-stage payload from one of the numerous embedded URLs. The extensive use of obfuscation and the high ML score suggest a sophisticated threat.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 6

  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.arachnophobia.no/users-manual-for-sprint-katana-top.html
    • http://www.perfumessence.com.ve/health-food-store-austintown-oh-top.html
    • http://animeentertainment.net/Order-Colospa-top.html
    • http://ccrcosa.com/2006-america-model-next-top-top.html
    • http://www.ipoint-tv.com/pink-porn-qidua.info-site-star-top.html
    • http://www.ipoint-tv.com/free-pic-of-child-model-top.html
    • http://animeentertainment.net/buy-fipronil-for-ants-top.html
    • http://ccrcosa.com/young-ebony-ass-top.html
    • http://www.arachnophobia.no/i-believe-yolanda-adams-sheet-music-top.html
    • http://www.lacapelle-masmolene.fr/nowadays-sheet-music-top.html
    • http://www.lacapelle-masmolene.fr/goa-india-print-top.html
    • http://www.ipoint-tv.com/magic-shave-top.html
    • http://www.perfumessence.com.ve/architectural-house-plans-blueprints-top.html
    • http://www.perfumessence.com.ve/goody-hall-activity-sheet-top.html
    • http://www.ecosystems.nl/tag/zvcm.php?arg=Get+Levaquin
    • http://animeentertainment.net/Buy-Orlistat-top.html
    • http://www.arachnophobia.no/xml-spreadsheet-compatibility-top.html
    • http://ccrcosa.com/extreme-toon-sex-top.html
    • http://www.perfumessence.com.ve/b-blood-food-type-top.html
    • http://www.arachnophobia.no/food-analysis-software-free-downloads-top.html
    • http://www.perfumessence.com.ve/ipod-print-ads-2009-top.html
    • http://www.lacapelle-masmolene.fr/basic-character-sheet-d-d-top.html
    • http://www.perfumessence.com.ve/wells-fargo-financial-worksheet-top.html
    • http://acps.allconet.org/kjdsuy/mjhy.php?arg=sheet+music+heavy+action+johnny+pearson
    • http://www.ipoint-tv.com/cummings-lesbian-summer-top.html
    • http://animeentertainment.net/Order-Premarin-top.html
    • http://ccrcosa.com/certificate-city-gift-havasu-lake-restaurant-top.html
    • http://www.zenithadmin.com/jsgtde/gyav.php?arg=Lanoxin+Sale
    • http://acps.allconet.org/kjdsuy/mjhy.php?arg=review+sheet+rappaccini%27s+daughter
    • http://acps.allconet.org/kjdsuy/mjhy.php?arg=sprint+car+phrases
    • http://www.lacapelle-masmolene.fr/friskies-can-cat-food-review-top.html
    • http://www.arachnophobia.no/dts-delete-worksheet-top.html
    • http://www.ipoint-tv.com/1920-kkk-leaders-top.html
    • http://animeentertainment.net/wellbutrin-online-prescription-top.html
    • http://ccrcosa.com/meagan-good-oops-top.html
    • http://www.lacapelle-masmolene.fr/food-testing-lab-pune-top.html
    • http://www.arachnophobia.no/escondido-california-sprint-dsl-top.html
    • http://www.zenithadmin.com/jsgtde/gyav.php?arg=Parlodel+Sale
    • http://www.arachnophobia.no/food-safety-free-video-top.html
    • http://ccrcosa.com/teenage-mutant-ninja-turtles-rom-top.html
    • http://animeentertainment.net/Purchase-Tiazac-top.html
    • http://acps.allconet.org/kjdsuy/mjhy.php?arg=blueprint+mark-up+software
    • http://acps.allconet.org/kjdsuy/mjhy.php?arg=interfaith+food+shelf+plattsburgh
    • http://www.ipoint-tv.com/adam-sandler-hanukkah-song-3-top.html
    • http://www.ipoint-tv.com/asian-hard-ass-top.html
    • http://www.ecosystems.nl/tag/zvcm.php?arg=Generic+Lasix
    • http://www.ecosystems.nl/tag/zvcm.php?arg=Aleve+For+Less
    • http://animeentertainment.net/Buy-BuSpar-top.html
    • http://ccrcosa.com/stretched-ass-hole-top.html
    • http://www.zenithadmin.com/jsgtde/gyav.php?arg=Get+Wellbutrin
    +44 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000bb23.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc
decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBB23 264072 bytes
embedded_pdf_script_0003d447.bin
3602f2a7dc2eccb77006ee219867944ce5a27c7e54f610e75c3fd18bbbb7be2a
pdf-embedded-script PDF decompressed stream script payload at offset 0x3D447 251154 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).