Malicious PDF — malware analysis report

Static analysis result for SHA-256 91769f57684a704d…

MALICIOUS

PDF

2.15 MB Created: 2006-04-24 17:15:50 +02:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 7.0.5 (Windows))
MD5: c811805cd4292b0c3bceccbd1dc40a99 SHA-1: 7a002cac3ee7942e23e0c072b1494c3a2ef36639 SHA-256: 91769f57684a704dba0041810c023ed85fa0ad1184acb5c215a44a13a4616ba8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains a critical heuristic firing for a launch action, specifically targeting cmd.exe. The command executed is designed to create a VBScript file named 'vbs1.vbs'. This script likely downloads and executes a second-stage payload, indicated by the command structure and the nature of PDF launch actions. The embedded URL heuristic also suggests external content is referenced, though the specific URL is benign.

Heuristics 3

  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off000054fa.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x54FA 3144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.