Malicious PDF — malware analysis report

Static analysis result for SHA-256 9880085436d972ae…

MALICIOUS

PDF

788 B
MD5: 515e063e281f32c5f8f312d67ffe469f SHA-1: ece20db2799f26320de79cb58d33262ab26579a3 SHA-256: 9880085436d972aeb3a69da42349ab4fde553b9bf5495a05d23de0e3d8c582b2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1204.002 Malicious File

The PDF file contains a launch action that executes cmd.exe. This command is used to echo a VBScript payload into a file named m.vbs. The VBScript payload is obfuscated using string reversal for 'Scripting.FileSystemObject' and 'WScript.Shell', indicating it likely performs malicious actions such as downloading and executing further stages from the embedded URL http://06.2sdmsdz.co.cc/x/img.php?d=1.

Heuristics 4

  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • /Launch action target: cmd high PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c echo B="m.vbs":With CreateObject(StrReverse("PTTHLMX.2LMXSM"'.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://06.2sdmsdz.co.cc/x/img.php?d=1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00000067.bin
ad55c8e83a5896a04b2012c676820daeab2b84cc539e444c6366e79f55a571c5		 pdf-embedded-script PDF decompressed stream script payload at offset 0x67 63 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.