Malicious PDF / .BIN — malware analysis report

Static analysis result for SHA-256 9da68c2e5f4dc86f…

MALICIOUS

PDF / .BIN

2.70 MB Created: 2007-05-30 13:36:49 -04:00 Authoring application: Acrobat Editor 8.0 (via Adobe Acrobat 8.0) First seen: 2018-07-27
MD5: 5296547916a7f72bbcaec57b49d3712c SHA-1: 0ef4d3e41658e620354871c0d908f968e290f3cb SHA-256: 9da68c2e5f4dc86f838ff625a0c4c191f7c34ac77d2791b26f84d2374f3e5e4f
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript that attempts to trick the user into downloading a fake update by displaying alert boxes and redirecting to a URL. The script reconstructs the URL 'the embedded link' for this purpose. Additionally, a suspicious executable named 'XVI32.exe' was found embedded within the PDF, suggesting it's a dropped payload. The presence of XFA forms and JavaScript actions points towards an attempt to exploit PDF vulnerabilities or trick users into executing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8277

Heuristics 11

  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.appliedsec.com/files/The_Evolving_Art_of_Fuzzing.pdf PDF link annotation
    • http://www.appliedsec.com/resources.htmlIn PDF document text
    • http://www.vdalabs.com/homeIn PDF document text
    • http://www.vdalabs.com/servicesIn PDF document text
    • http://www.vdalabs.com/about_usIn PDF document text
    • http://www.vdalabs.com/contact_usIn PDF document text
    • http://www.vdalabs.com/In PDF document text
    • http://www.vdalabs.comIn PDF document text
    • http://www.appliedsec.com/files/The_Evolving_Art_of_Fuzzing.pdf)/S/URIIn PDF document text
    • http://www.appliedsec.com/resources.html)/S/URIIn PDF document text
    • http://www.vdalabs.com/home)/S/URIIn PDF document text
    • http://www.vdalabs.com/services)/S/URIIn PDF document text
    • http://www.vdalabs.com/about_us)/S/URIIn PDF document text
    • http://www.vdalabs.com/contact_us)/S/URIIn PDF document text
    • http://www.vdalabs.com/)endobj77In PDF document text
    • http://www.vdalabs.com)/SIn PDF document text
    • http://www.monotype.comMonotypeIn PDF document text
    • http://media.defcon.org/dc-14/video/Defcon14-V42-Jared_DeMott-Evolving_art_of_Fuzzing.mp4In PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/bg_loop.gifIn PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/hd_bg1.jpgIn PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/nav_bg.gifIn PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://media.defcon.org/dc-14/video/Defcon14-V42-Jared_DeMott-Evolving_art_of_Fuzzing.mp4)/S/URIIn PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/bg_loop.gif)endobj71In PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/hd_bg1.jpg)endobj73In PDF document text
    • http://us.i1.yimg.com/us.yimg.com/lib/smb/assets/hosting/yss/themes/tangiers/v_1_24/images/nav_bg.gif)endobj75In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.5/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.5/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0053.bin pdf-embedded-file PDF EmbeddedFile object 53 at offset 0x9DA6 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0059.bin pdf-embedded-file PDF EmbeddedFile object 59 at offset 0xAC69 480 bytes
SHA-256: beab7113c323ee35ecc46dd04fe6c7836a7e1d2cedd524508b8e90edfb6b89f3
XVI32U.HLP pdf-embedded-file PDF EmbeddedFile object 62 at offset 0xAEA1 104592 bytes
SHA-256: 1663d709ead4d7f372b7e1f0a30ef34e7610b7c9446e3eae24b69a49eacbc330
XVI32.exe pdf-embedded-file PDF EmbeddedFile object 63 at offset 0x1EDFB 879616 bytes
SHA-256: 0c3e24137784be289a27e6f88228ce117804c2bc4b5c9498cf9ca95678e543b2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=XVI32.exe; kind=pdf-embedded-file
javascript_obj0271_000.js pdf-javascript-stream PDF /JS object 271 at offset 0xCE057 123 bytes
SHA-256: 47a11af261864e11a9114c4b8341a8d88c020beda8ccb542c182f131c84bc11f
Preview script
First 1,000 lines of the extracted script
function FormWorkFlowData(p) { var s; switch (p) { case "WF_CTT": s = "true"; break; default: s = "";  break; } return s; }
javascript_obj0132_001.js pdf-javascript-stream PDF /JS object 132 at offset 0x8E432 1535 bytes
SHA-256: e3e351675eabd51ed0a9b2a42fdbd26abed2160bc835c82b759bad35673da1ea
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.5)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0133_002.js pdf-javascript-stream PDF /JS object 133 at offset 0x8E61E 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0134_003.js pdf-javascript-stream PDF /JS object 134 at offset 0x8E779 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
stream_011_off00009e45.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9E45 2127 bytes
SHA-256: 83f00d1c41b1e9c40733e8d585d816806db1325d0b30139e1e7ad824756e1ad9
stream_012_off0000a1a2.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA1A2 4410 bytes
SHA-256: ecf8483394da370b944a29c9fe6e967f936a6dc2401321d6f7e4c519cc950459
stream_013_off0000a7d4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA7D4 201 bytes
SHA-256: 07c9c7a0cedc7ade5cfada184c65cf01513c940b63bf164df254c73a81e9ccc4
stream_014_off0000a8a0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA8A0 2423 bytes
SHA-256: 2d58413fda1ff20c994606823bf49e41194612c0137b6315e50fa7bdc01f1e09
stream_043_off00096ce6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x96CE6 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_074_off000d5d69.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD5D69 557168 bytes
SHA-256: 35f401731df11a4eba3502af632e51d68bc394bcb7d34632a331c1ba3f4a0bf6
font_00_sfnt_off000019e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19E4 20485 bytes
SHA-256: 1489ea6e627ac8437f3b1545090c796f020941d414776de8ba46e384f1cbdb6d

Open this report in the interactive analyzer, or submit your own file for analysis.