Malicious PDF — malware analysis report

Static analysis result for SHA-256 95ce846dc425bb5b…

MALICIOUS

PDF

590.7 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: d50acc18738424a6b1aca58f2ef3ab08 SHA-1: 89075c23439891523fd4a2cf17b5089adb144b38 SHA-256: 95ce846dc425bb5b58a12427ea3293b87f2ce7c8c82c00576813e7c352129d7b
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell

The file is identified as a malicious PDF by ClamAV and an ML classifier. Heuristics indicate the presence of embedded content and remote actions, suggesting it's designed to deliver further malicious content or exploit vulnerabilities. The 'Pdf.Dropper.Agent-7284341-0' detection name points towards a dropper functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7284341-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7284341-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
hoag_earth_32.pdf
6b2d78c1f46b2a94b929385591c1a11d89013081ff5dc2a36d1e1e719572a855		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E2 262499 bytes
hoag_earth_32_1.pdf
75b8b69bd1314aa13d7adff3fd25e545dc12235a671a444031088588cc345c73		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E2 348962 bytes
hoag_earth_32_2.pdf
72dfb0ffb91d55c29119e93f55e06c138023a67fa28a8706f8bd9eb4c680d0b5		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E2 435487 bytes
stream_019_off0001a01d.bin
704ed331cdeaf78b4f4c6b2bc9752f7c9f37384918108dc0756de8ddc4af7a99		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01D 522052 bytes
objstm_0121_00.bin
8f4b2344052524ef59ef27634aadcca0887df85657bcba744be778ce51b13bf5		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1105 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.