Malicious PDF — malware analysis report

Static analysis result for SHA-256 ade605fba8585df8…

MALICIOUS

PDF

263.2 KB Created: 2001-09-10 15:47:24 UTC Authoring application: Acrobat Distiller 4.0 for Windows First seen: 2015-10-03
MD5: da21f1da8b7a05b45242ec9b0d899690 SHA-1: 53c1393a221a26c5274f020c27fa8eecf957762d SHA-256: ade605fba8585df83a44a6c0049a4687664e729cba81adbb6ae8ebc6af417e4e
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1204.001 Malicious Link

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The presence of eval() and String.fromCharCode suggests obfuscated code execution. The CCITTFaxDecode heuristic combined with the CVE-2010-0188 indicator points to a known exploit path. The extracted artifact 'javascript_obj0135_000.js' is likely the payload. The benign URLs are likely unrelated to the malicious functionality.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3612

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       for (ct = 0; ct<tp; ct++) {
       v1 = eval("1"+s1.substring(ct * 3 + 6,ct * 3 + 9)+"-1000");
       v2 = (((tp - ct + 3) % 3) + 1);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0135_000.js pdf-javascript-stream PDF /JS object 135 at offset 0x3FEB5 1446 bytes
SHA-256: ca2c34fbd62c0f2b212d935995d68160a4b677acb6920f60baf443e9e3c891cc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var d;
var f;
var s1;
var s2;
var s3;
var ct;
var chk;
var tp;
var v1;
var v2;
var dt;

d = event.target;
f = d.getField("licenca");

if (global.numero_serie) {
   s1 = global.numero_serie;
   tp = 50;
   chk = 0;
   s2 = "";
   for (ct = 0; ct<tp; ct++) {
       v1 = eval("1"+s1.substring(ct * 3 + 6,ct * 3 + 9)+"-1000");
       v2 = (((tp - ct + 3) % 3) + 1);
       s2 = String.fromCharCode(v1 / v2) + s2;
       chk = chk + (v1 / v2) * (((tp - ct) % 10) + 1);
   }

   if ((chk % 1000) == eval("1" + s1.substring(0,3) + "-1000") ) {

      s3 = "Licen�a de uso exclusivo para " + s2.substring(0, eval("1" + s1.substring(3,6) + "-1000") );

      s1 = s1.substring(tp*3+6);
      tp = 20;
      chk = 0;
      s2 = "";
      for (ct = 0; ct<tp; ct++) {
         v1 = eval("1" + s1.substring(ct * 3 + 6,ct * 3 + 9) + "-1000");
         v2 = (((tp - ct + 3) % 3) + 1);
         s2 = String.fromCharCode(v1 / v2) + s2;
         chk = chk + (v1 / v2) * (((tp - ct) % 10) + 1);
      }
      dt = new Date();
      if ((chk % 1000) == eval("1" + s1.substring(0,3) + "-1000") ) {
         s3 = s3 + String.fromCharCode(13) + "C�pia impressa pelo sistema "  + s2.substring(0, eval("1" + s1.substring(3,6) + "-1000") ) + " em " + util.printd("dd/mm/yyyy", dt);
      }
      else {
         s3 = f.defaultValue;
      }
   }
   else {
      s3 = f.defaultValue;
   }
   f.value = s3;
}
else {
   f.value = f.defaultValue;
   app.alert(f.userName);
}
font_00_sfnt_off00031711.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31711 11112 bytes
SHA-256: d194d25a4cecdf25153242568a168e246e2411f73127f0d7e99f6364acb8c325

Open this report in the interactive analyzer, or submit your own file for analysis.