PDF malware analysis — malicious · a4cd3de56554536c

MALICIOUS

PDF

94.0 KB Created: 2010-05-29 04:10:48 +00:00 Authoring application: ReportLab http://www.reportlab.com

MD5: e1ec188d5b041fcbacbdadebc0de6c8d SHA-1: db0234b544c83895bf7da9900e40f2ffbbd7804c SHA-256: a4cd3de56554536c3e8b33c70a9c93250ab869b7477be53ea89b8f70b140b44c

118 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: Malicious Link T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link

The PDF contains a direct link to an executable or archive payload, indicated by the 'PDF_DIRECT_PAYLOAD_LINK' heuristic. The document body and numerous URLs relate to payment services, suggesting a lure for financial fraud or credential theft. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9277

Heuristics 6

PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK

PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://en.wikipedia.org/w/index.php?title=Payment_service_provider
- http://en.wikipedia.org/w/index.php?title=24x7payments.com
- http://en.wikipedia.org/w/index.php?title=AlertPay
- http://en.wikipedia.org/w/index.php?title=Barclaycard_ePDQ
- http://en.wikipedia.org/w/index.php?title=Beenz
- http://en.wikipedia.org/w/index.php?title=Bucks_Net
- http://en.wikipedia.org/w/index.php?title=CyberBucks
- http://en.wikipedia.org/w/index.php?title=DigiCash
- http://en.wikipedia.org/w/index.php?title=CyberCoin
- http://en.wikipedia.org/w/index.php?title=Datacash
- http://en.wikipedia.org/w/index.php?title=ECash
- http://en.wikipedia.org/w/index.php?title=Elavon
- http://en.wikipedia.org/w/index.php?title=FasterPay
- http://en.wikipedia.org/w/index.php?title=Firstgate
- http://en.wikipedia.org/w/index.php?title=Flooz
- http://en.wikipedia.org/w/index.php?title=Heidelpay
- http://en.wikipedia.org/w/index.php?title=HSBC
- http://en.wikipedia.org/w/index.php?title=IKobo
- http://en.wikipedia.org/w/index.php?title=IKP
- http://en.wikipedia.org/w/index.php?title=LibertyReserve
- http://en.wikipedia.org/w/index.php?title=MagicMoney
- http://en.wikipedia.org/w/index.php?title=Microeuro
- http://en.wikipedia.org/w/index.php?title=MicroMint
- http://en.wikipedia.org/w/index.php?title=Micromoney
- http://en.wikipedia.org/w/index.php?title=MilliCent
- http://en.wikipedia.org/w/index.php?title=Mondex
- http://en.wikipedia.org/w/index.php?title=Moneybookers
- http://en.wikipedia.org/w/index.php?title=MPAY24
- http://en.wikipedia.org/w/index.php?title=NetCash
- http://en.wikipedia.org/w/index.php?title=Ouroboros
- http://en.wikipedia.org/w/index.php?title=Pago
- http://en.wikipedia.org/w/index.php?title=PayMe
- http://en.wikipedia.org/w/index.php?title=PayPal
- http://en.wikipedia.org/w/index.php?title=PayPay
- http://en.wikipedia.org/w/index.php?title=PayPoint.net
- http://en.wikipedia.org/w/index.php?title=PaySafeCard
- http://en.wikipedia.org/w/index.php?title=PayYourRent.com
- http://en.wikipedia.org/w/index.php?title=PayXpert
- http://en.wikipedia.org/w/index.php?title=PayWord
- http://en.wikipedia.org/w/index.php?title=PeerTransfer
- http://en.wikipedia.org/w/index.php?title=Peppercoin
- http://en.wikipedia.org/w/index.php?title=Qunits.net
- http://en.wikipedia.org/w/index.php?title=RBS_WorldPay
- http://en.wikipedia.org/w/index.php?title=Realex
- http://en.wikipedia.org/w/index.php?title=RentPayment
- http://en.wikipedia.org/w/index.php?title=Sage_Pay
- http://en.wikipedia.org/w/index.php?title=Safecharge
- http://en.wikipedia.org/w/index.php?title=Secure_Trading
- http://en.wikipedia.org/w/index.php?title=SIX_Card_Solutions_GmbH
- http://en.wikipedia.org/w/index.php?title=SubScrip
+19 more URL(s)

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0084.bin` `d81baa73e490e4cb879e13927cacd1dd1be37524a37eac51603e15117c578777`	pdf-embedded-file	PDF EmbeddedFile object 84 at offset 0x1371E	84 bytes
`embedded_file_obj0085.bin` `24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0`	pdf-embedded-file	PDF EmbeddedFile object 85 at offset 0x137BD	228 bytes
`embedded_file_obj0086.bin` `0880662c9a44d5cc6739878bb6a1abcc84fb931b5e4e6d3be63fd7be3869b391`	pdf-embedded-file	PDF EmbeddedFile object 86 at offset 0x13952	31834 bytes
`embedded_file_obj0087.bin` `c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460`	pdf-embedded-file	PDF EmbeddedFile object 87 at offset 0x16BCC	199 bytes
`embedded_file_obj0088.bin` `846dfecc0c93797cb6db4301f6af323fffd76ffdf8c053c439495412785138e7`	pdf-embedded-file	PDF EmbeddedFile object 88 at offset 0x16CDE	119 bytes
`embedded_file_obj0089.bin` `e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876`	pdf-embedded-file	PDF EmbeddedFile object 89 at offset 0x16D9F	77 bytes
`embedded_file_obj0090.bin` `92a3ce61d783e15932b5de127ce45a9b4c2f98f4da2453f65241573c1dda808a`	pdf-embedded-file	PDF EmbeddedFile object 90 at offset 0x16E36	56 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.