Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3c27e9063b62ed6…

MALICIOUS

PDF

553.2 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 2b95620e4cf6d2d891297c225abaf2d0 SHA-1: f61224df6076ed038590441fa21e4b226fd0f4e8 SHA-256: a3c27e9063b62ed6e7fb56ce5971748c4fb2ee171ff3d1d44be7dfbcbf610047
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits suspicious characteristics, including embedded PDF files and remote GoTo actions, indicating a potential attempt to deliver further malicious content. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of embedded PDFs and the remote GoTo action strongly suggest a multi-stage attack pattern. The benign URLs are likely part of the PDF's metadata or structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
black-eye_uranus_88.pdf
9762f2fcc1f14b82aa7d03fe9e08c0222918f113d06e072b3e7bc2f0a8aa331b		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 224049 bytes
black-eye_uranus_88_1.pdf
1efa0101a2ba60dad5d5f4c2e386f10be34669e9769f9a636c1246fd72f2fd3b		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 310558 bytes
black-eye_uranus_88_2.pdf
f5bd111b2a96e25e83e6c432255eb57a8a575980dbf4418435d60e4877290225		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 397014 bytes
stream_019_off0001a024.bin
64fe14c0eac14cbe646da65c607ccae8df4a4928fbc53f7c7e7fd75e3a03f032		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A024 483550 bytes
objstm_0121_00.bin
f3ff9456c5014ab16eef3e0bfae2d35a948b0055b1e3ca83fce4ad4919be0063		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1123 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.