Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2344757baa0c551…

MALICIOUS

PDF

166.8 KB Created: 2008-05-21 16:10:52 +08:00 Authoring application: Acrobat PDFMaker 6.0 for Word (via Acrobat Distiller 6.0 (Windows))
MD5: 371849d889d70c2cf4263c128d62f16a SHA-1: 860a65fce8cd3bdf8f2bc8ac1a1b67d7034487c0 SHA-256: a2344757baa0c551025628d5b6ad27d28d94fd795733eee985dcb881e049dfb0
164 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1553.005 Mark-of-the-Web Bypass

The PDF file contains embedded JavaScript and a secondary embedded PDF, as indicated by the PDF_JAVASCRIPT, PDF_JS, and POLYGLOT_CHILD_PDF_STATIC_TRIAGE heuristics. The ClamAV detection of 'Pdf.Dropper.Agent-7288718-0' further confirms its malicious nature. The embedded artifacts suggest the PDF is designed to download and execute a second-stage payload, likely exploiting vulnerabilities or using social engineering tactics.

Heuristics 9

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • ClamAV: Pdf.Dropper.Agent-7288718-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7288718-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/xhtml
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0026_000.js
8d51f20714d2655b1d6b5c68289c60ee305fe38697190a592bbd4283b5353107		 pdf-javascript-stream PDF /JS object 26 at offset 0xA9E 1152 bytes
icc_00_off0000e07c.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0xE07C 3144 bytes
polyglot_child_pdf_off0000c955.pdf
e304bcd16abeae58e0ebfc539c356bff1cd92cea12958697c92dfd1476eae2b1		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0xC955 119274 bytes
polyglot_child_pdf_off00021950.pdf
e257c4c78a63eeed14b0486919fd0f3ca52fcb70fb8b5e0876113969c27e9281		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x21950 33263 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.