Malicious PDF — malware analysis report

Static analysis result for SHA-256 a843c6199384ddcd…

MALICIOUS

PDF

3.26 MB Created: 2010-11-12 16:05:24 +08:00 Authoring application: Writer (via OpenOffice.org 3.0)
MD5: 01ac4b01ed5ff170097c0e10994a9cd7 SHA-1: 6c9d14d843f642592a138ed410043465516bd169 SHA-256: a843c6199384ddcdf6220535df7c1f77f41b1a0310d81af8739f290e7bd4d9bd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file exhibits multiple high-severity heuristic firings, including the presence of JavaScript, embedded files, and rich media (Flash). A critical finding indicates a secondary embedded PDF with suspicious static findings. The ML classifier also flagged this PDF as malicious. These indicators suggest the file is designed to execute malicious code, likely through the embedded JavaScript or Flash content, potentially leading to further exploitation or payload delivery. The presence of multiple embedded PDFs further supports a complex attack chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8026

Heuristics 7

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0027_00.bin
667b2c75ccf7ac530ab7ab1335ed88701c878c9bd33ce7626a853b18be32e7d1		 pdf-objstm-decoded PDF /ObjStm 27 0 obj (inflated) 1170 bytes
polyglot_child_pdf_off00044069.pdf
041e1e156dcdb4f61c24eea300070b6439bf59af3b74fa794087e7cd256f781c		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x44069 3144517 bytes
polyglot_child_pdf_off000444f9.pdf
277c37fa6de470ead90fc226bf6f728a16fa2c3a226017f5121c4c37aa4eda45		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x444F9 3143349 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.