Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 94d126e6597dd1da…

MALICIOUS

PDF / .VIR

410.6 KB Created: 2008-12-12 09:44:08 -05:00 Authoring application: Adobe LiveCycle Designer 8.0 First seen: 2024-06-27
MD5: a46f77f49a3797ce5b115d2d774b7565 SHA-1: ca18f4b4b2634a28d14c6dced7834d31a8d5f136 SHA-256: 94d126e6597dd1da89d6adf0f79d20594c93c987474bd17fbf11313b7f4c9e1e
86 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9412

Heuristics 7

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In extracted file (stream_010_off00004bea.bin)
    • http://ocsp.verisign.com0In extracted file (font_06_sfnt_off000411e7.bin)
    • http://www.usitc.gov/tata/hts/In extracted file (embedded_file_obj0126.bin)
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In extracted file (embedded_file_obj0124.bin)
    • http://www.xfa.org/schema/xci/1.0/In extracted file (embedded_file_obj0125.bin)
    • http://www.xfa.org/schema/xfa-template/2.5/In extracted file (embedded_file_obj0126.bin)
    • http://www.w3.org/1999/xhtmlIn extracted file (embedded_file_obj0126.bin)
    • http://www.xfa.org/schema/xfa-data/1.0/In extracted file (embedded_file_obj0126.bin)
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In extracted file (embedded_file_obj0127.bin)
    • http://ns.adobe.com/xtd/In extracted file (embedded_file_obj0129.bin)
    • http://ns.adobe.com/xfdf/In extracted file (embedded_file_obj0131.bin)
    • http://www.xfa.org/schema/xfa-form/2.5/In extracted file (embedded_file_obj0132.bin)
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn extracted file (stream_010_off00004bea.bin)
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn extracted file (stream_013_off0001bbf8.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_06_sfnt_off000411e7.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_06_sfnt_off000411e7.bin)
    • https://www.verisign.com/rpaIn extracted file (font_06_sfnt_off000411e7.bin)
    • https://www.verisign.com/rpa01In extracted file (font_06_sfnt_off000411e7.bin)
    • http://crl.verisign.com/pca3.crl0In extracted file (font_06_sfnt_off000411e7.bin)
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn extracted file (font_06_sfnt_off000411e7.bin)
    • https://www.verisign.com/rpa0In extracted file (font_06_sfnt_off000411e7.bin)
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In extracted file (font_06_sfnt_off000411e7.bin)
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn extracted file (font_06_sfnt_off000411e7.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0124.bin pdf-embedded-file PDF EmbeddedFile object 124 at offset 0x510E4 162 bytes
SHA-256: f7f67aef032b710631a183ede13090c31a5ea29455ed6043785c7b0fb5b77dec
embedded_file_obj0125.bin pdf-embedded-file PDF EmbeddedFile object 125 at offset 0x511D7 3277 bytes
SHA-256: 907e2f6f400e7604954184d01147725c8a9dcf72e312c5c8dc5cb8a233484c40
embedded_file_obj0126.bin pdf-embedded-file PDF EmbeddedFile object 126 at offset 0x516C1 255073 bytes
SHA-256: 7b6c8184841137f7652412a37529b9adb721338c30720c04c166e5091693dfe4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
1793 of 2894 identifiers look randomly generated (e.g. 'B000C00110012001300140015001600170018001'); 33 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 4 long base64-like blob(s).
embedded_file_obj0127.bin pdf-embedded-file PDF EmbeddedFile object 127 at offset 0x61233 2423 bytes
SHA-256: 2d58413fda1ff20c994606823bf49e41194612c0137b6315e50fa7bdc01f1e09
embedded_file_obj0128.bin pdf-embedded-file PDF EmbeddedFile object 128 at offset 0x61516 3626 bytes
SHA-256: f17a17c7ad44771eaa70b2371db9f61a7a8791546f51718c72db266f8347e569
embedded_file_obj0129.bin pdf-embedded-file PDF EmbeddedFile object 129 at offset 0x61690 214 bytes
SHA-256: 7e915b5dd2e321929666a7b64c038b67678092d6e43a4a70683521856a4d5128
embedded_file_obj0130.bin pdf-embedded-file PDF EmbeddedFile object 130 at offset 0x6178C 799 bytes
SHA-256: a2ca8d76ed68174e76a32f08dc76172be22b3080e4c5c373c29eed3d99a3b9eb
embedded_file_obj0131.bin pdf-embedded-file PDF EmbeddedFile object 131 at offset 0x6199C 110 bytes
SHA-256: b1b296d371e691ae903fc90e2f3bd69eeac3730137d7c7f5d9379aed02cb51d6
embedded_file_obj0132.bin pdf-embedded-file PDF EmbeddedFile object 132 at offset 0x61A4D 7937 bytes
SHA-256: a47f773b03fc9a45fab296493b3a2e8b347499c4f35df541e056b2f364819cc6
javascript_obj0539_000.js pdf-javascript-stream PDF /JS object 539 at offset 0xAEF 1383 bytes
SHA-256: 40d207bd33ef19f74e77d6e0bc9aa193e7355fc39dc66f9669dd2d0a8de76db6
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.5)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0540_001.js pdf-javascript-stream PDF /JS object 540 at offset 0xCD6 902 bytes
SHA-256: 91ea259764c68d27b8981a339c02d8ea92224ae5c0d0cd0a7c8f3d645d599090
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.0)
{
   ADBE.Reader_Need_Version = 8.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.0)
{
   ADBE.Viewer_Need_Version = 8.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0541_002.js pdf-javascript-stream PDF /JS object 541 at offset 0xE31 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
stream_010_off00004bea.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BEA 78315 bytes
SHA-256: 90e05f12433fff19e80f5733b152834eeadd53d896969a8a877e57a4d66e5081
stream_013_off0001bbf8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BBF8 77922 bytes
SHA-256: 6a773dd153389bd279637c0bd5fec2989000e57a9530aab27da2d29cb25763de
font_01_sfnt_off0000e4bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4BC 91718 bytes
SHA-256: 795b60bc4863d8bfb1456a83e79c04eda050724e7c54892448b99850e15ab094
font_02_cff_off0001a90b.bin pdf-font-stream PDF embedded font (cff) at offset 0x1A90B 5127 bytes
SHA-256: a125e44618437cae7eba45dce63366916ab6cb6dbed58dfba5036e66366e9616
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.41, consistent with packed or encrypted content.
font_04_cff_off000324c6.bin pdf-font-stream PDF embedded font (cff) at offset 0x324C6 1663 bytes
SHA-256: 13c040eb52a855ad362988909c8e4ed38c8cbcdc1bd0714d6fcae836837ba9a1
font_05_sfnt_off00034931.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34931 41282 bytes
SHA-256: 58247b7116c4207c9c45181a2075b8f46bdffb676cca8a5d68921906517081dc
font_06_sfnt_off000411e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x411E7 94875 bytes
SHA-256: 058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20

Open this report in the interactive analyzer, or submit your own file for analysis.