PDF malware analysis — malicious · ac3d6089d4591958

MALICIOUS

PDF

30.2 KB Created: 2022-07-14 06:48:56 -07:00 Authoring application: Writer (via LibreOffice 7.2)

MD5: c1ded96d871970fe7884cb9349ef0aa1 SHA-1: 352550368487bd0d39fea33bf271fc1c649f70da SHA-256: ac3d6089d459195800931784a175b31fd65e20a937488acd95477db7dd253280

352 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains an OpenAction trigger that executes embedded JavaScript. This script utilizes a PowerShell download cradle to fetch and execute a second-stage payload. The specific PowerShell command observed is 'powershell -EncodedCommand cDF6c2MwRCV3cW53bm5qZWt3aW56JXN0bmVtdWNvRCU6QyBodGFQbm9pdGFuaXRzZUQtIGV0YWRwVS0gKiVzdG5lbXVjb'. This indicates a common delivery mechanism for malware, where the initial PDF acts as a loader for further malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 0.8508

Heuristics 8

/Launch action target: \103:\\Windows\\system32\\cmd.exe /C 'Powershell' critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target — references a known-dangerous executable (cmd, PowerShell, etc.).
PowerShell download cradle in PDF action body critical PDF_PS_DOWNLOAD_CRADLE

PDF contains a PowerShell download-and-execute cradle (IEX/Invoke-Expression of a remote payload, [Net.WebClient]/[Net.ServicePointManager], or `-ep Bypass -enc <base64>`). These strings are rare in benign PDFs and are strong evidence of payload staging in an attack chain (MITRE T1059.001 + T1105).
OpenAction trigger high PDF_OPENACTION

PDF has an /OpenAction that launches, submits, or opens an external target
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_000066a8.bin` `0dd9ad745be29e7adbcc81b3ae812182524721745cd0400ece55c90c5f19994b`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x66A8	30961 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains a PowerShell -EncodedCommand style payload. Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`font_00_sfnt_off00002d89.bin` `45a84addfaf04e2b92ae6c5d138087a7c0f22ee31295e060e7323235e1f94e42`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2D89	22348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.