PDF malware analysis — malicious · a524ac3c22884810

MALICIOUS

PDF

360.7 KB Created: 2011-04-16 14:11:46 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: e2fa712673226e8648ee570073a994b6 SHA-1: cadce0f301fc698bd679e17e79e07a1bf597c3e0 SHA-256: a524ac3c2288481065319113cca58826500cb19673ce51eede4d38f311ca9614

62 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The PDF file contains a critical heuristic firing for CVE-2008-2551, indicating it exploits a vulnerability in Adobe Reader. The embedded URL points to a CAB file which likely contains the exploit, and another URL is present that likely hosts the secondary payload. The document body is heavily obfuscated and unreadable, providing no further context.

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off000019ca.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x19CA	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.