PDF malware analysis — malicious · aca1d2a628f3be36

MALICIOUS

PDF

5.72 MB Created: 2017-11-14 22:41:43 +03:00 Authoring application: Microsoft® Word 2013

MD5: bd1d4e210a1226629a887037c87b018b SHA-1: e19f8822d6554d08e82fc62818ba91d93da40ab9 SHA-256: aca1d2a628f3be36959612ac93f337fca026f85cb0d6e1c43ec1a74bdc5bd175

228 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains heuristics indicating it uses a launch action to execute cmd.exe, which in turn appears to be preparing to execute a script. The document body, though heavily obfuscated, contains indicators of payment redirection lures. The embedded script payload is the primary mechanism for the attack, likely downloading and executing a second-stage payload.

Heuristics 6

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off00007116.bin` `3ae72603aa8ccc31c772c8eb73c792a38310815da09e10872d2cf032a5ced50b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x7116	246246 bytes
`stream_018_off0006f62f.bin` `c62da33cf0c666e726235a7f867f2f8d241d9299941a722107b6fdbd55f6a618`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6F62F	4194304 bytes
`stream_036_off00108a89.bin` `38115f104a2be287d273f27b39fd65875cd50bdf8fc0bb5b5847c59477987bd6`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x108A89	325488 bytes
`stream_039_off00134235.bin` `a764fce7f04b3c8efbb4281007f70394214dcfcee7b0ed4fa1dc5cd8dfd4fefb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x134235	366360 bytes
`embedded_pdf_script_001660f8.bin` `d4c10b6ac22a2119e57594a048a1755880c36e35b870ebe9eef223676528f243`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x1660F8	5993567 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.