Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b8da6321c2f4811…

MALICIOUS

PDF

1.2 KB
MD5: 6d688a633b4a670180323847cc70a7fe SHA-1: fb6c046cd70a78c11c90a2e84b03bc421ab87841 SHA-256: 9b8da6321c2f4811664630942c1eb41184ff5fc197072a76ac94bac67ca0e6e7
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains JavaScript that is automatically executed upon opening, as indicated by the PDF_OPENACTION_JS_SUBMITFORM heuristic. The embedded JavaScript attempts to submit form data to the URL http://employeeportal.net-login.com/XcmVsjaXBpZWL50X2lkPTBM0NTc4NaNjI3GMiZjYW1wwYWBlnbl9ydW5faWQ9MTE5dMzg4MiZhY3Rpb249YXR0YWNobWVudA==#FDF. This suggests a phishing attempt to harvest user credentials or deliver a secondary payload.

Heuristics 4

  • PDF auto-runs JavaScript form submission on open critical PDF_OPENACTION_JS_SUBMITFORM
    PDF uses /OpenAction to run JavaScript that calls submitForm() with an external HTTP(S) URL. Opening the document triggers the outbound submission path without requiring a normal link click.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://employeeportal.net-login.com/XcmVsjaXBpZWL50X2lkPTBM0NTc4NaNjI3GMiZjYW1wwYWBlnbl9ydW5faWQ9MTE5dMzg4MiZhY3Rpb249YXR0YWNobWVudA==#FDF

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
3faa4679cb9767473c52b200ec4499e5b45ddbefa6672452d10208c2503b9424		 pdf-javascript-stream PDF /JS object 7 at offset 0x30D 159 bytes
javascript_obj0007_001.js
96624b501f32b220d88ce22d2adcadd5f490b25230095c1b49b7be3541de6182		 pdf-javascript-stream PDF /JS object 7 at offset 0x30D 157 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.