Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aebd4bb8aac2f7c…

MALICIOUS

PDF

265.8 KB Created: 2010-03-16 03:24:16 Authoring application: Reporters Sans Frontières (via FPDF 1.53)
MD5: e030efbdb4aa67b5968cbfda60ebfdc4 SHA-1: 2863db288397fd0ed3f4cede126e514f3621ed1e SHA-256: 9aebd4bb8aac2f7c0b44aa3fe755820f8a0f9b64ad1401d6910fac714258b334
312 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits CVE-2009-4324 (media.newPlayer) and CVE-2008-2992 (util.printf). The JavaScript is heavily obfuscated but appears to be a downloader for a second-stage payload. The ML classifier also flagged this PDF as malicious. Several unknown reputation URLs were extracted, suggesting potential command and control or download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 10

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.Bullog.cn
    • http://www.tibettl.com/
    • http://www.cmbpd.cn/index.html
    • http://boxun.us/news/publish/
    • http://crd-net.org
    • http://www.hrichina.org/
    • http://www.rsf.org
    • http://www.google.cn
    • http://www.rfa.org/english/
    • http://www.t.people.com.cn
    • http://www.google.com
    • http://www.renren.com
    • http://www.51.com
    • http://www.tudou.com
    • http://www.youtube.com
    • http://cmp.hku.hk/
    • http://www.xinhuanet.com
    • http://sirc.blogspot.com
    • http://blog.sina.com.cn
    • http://blog.sina.com.cn/xujinglei

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
5c78a98ed6aa8a18e2f9ccb59bf471b75c654fd1be549089523ae9fee5b9c09e		 pdf-javascript-stream PDF /JS object 6 at offset 0x18B 6603 bytes
generic_stage_recovery_000.js
b4f13224acf173e48431bcb071cbd50d5d138ba6fdd20278d8f2544d0c57d230		 deobfuscated-js generic stage recovery percent-decode from JavaScript object 6 at offset 0x18B 5413 bytes
generic_stage_recovery_001.js
0cf18f1d62f710445714130921b2decf64e93a315ab9cd3005388400aad940ff		 deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from JavaScript object 6 at offset 0x18B 5407 bytes
polyglot_child_pdf_off00037013.pdf
8ab9b84b968c93576adb90ad639877b9977e3bb4c2a59e97c730d0dda1ffe2d5		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x37013 46919 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.