Malicious PDF — malware analysis report

Static analysis result for SHA-256 a19ca74a4360fbf3…

MALICIOUS

PDF

57.0 KB Created: 2011-05-26 13:19:13 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 84e2ef6e35a55aaf6bf2f0d8b7dca366 SHA-1: b543b6b5d4685fcf5acd94ecb3e5f1421d6cfad4 SHA-256: a19ca74a4360fbf32c37d68c02ce1b999e6a665a3e3591c7013fe9eb66995d26
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The PDF file contains a critical heuristic firing for the CVE_2008_2551 exploit, indicating it attempts to leverage this vulnerability. The embedded URL, although marked as benign, is associated with the exploit's potential download mechanism. The document body contains numerous URLs, but the primary threat stems from the exploit itself.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=1201393
    • http://www.irna.ir/View/FullStory/?NewsId=1201495
    • http://www.irna.ir/View/FullStory/?NewsId=1201438
    • http://www.farsnews.com/newstext.php?nn=8904061155
    • http://www.presstv.ir/detail.fa.aspx?id=132487&sectionid=351021501
    • http://www.presstv.ir/detail.fa.aspx?id=132417&sectionid=351021505
    • http://www.presstv.ir/detail.fa.aspx?id=132418&sectionid=351021501
    • http://www.presstv.ir/detail.fa.aspx?id=132388&sectionid=351021508
    • http://www.presstv.ir/detail.fa.aspx?id=132478&sectionid=351021504
    • http://www.presstv.ir/detail.fa.aspx?id=132427&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=132444&sectionid=351021507
    • http://www.irna.ir/View/FullStory/?NewsId=1201600
    • http://www.irna.ir/View/FullStory/?NewsId=1201590
    • http://www.farsnews.com/newstext.php?nn=8904071534
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00002518.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2518 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.