Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae73936c85c25a05…

MALICIOUS

PDF

41.5 KB Created: 2018-11-26 08:22:48 +03:00 Authoring application: - (via Mac OS X 10.6.7 Quartz PDFContext)
MD5: 8091e85cd00e32d94285a97d4f11b7a9 SHA-1: 8acf1c0bfd061bafcd8e5f515e84ae28f8601020 SHA-256: ae73936c85c25a0544d6c1e2fff1ee3282a8312452c46888ff7e80d9bd242ce9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains an embedded script payload, a common technique for delivering malicious content. The heuristic firings indicate that this script is designed to execute and potentially download further payloads. The document body and embedded artifacts are heavily obfuscated, but the presence of numerous external URLs suggests a lure to external resources. The primary intent appears to be directing the user to download additional malicious files from the listed URLs.

Heuristics 4

  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/chapter-01-bone-cell-biology-osteoclasts-osteoblasts-osteocytes-kindle-edition.pdf
    • http://www.gorillawalker.com/electric-energy-systems.pdf
    • http://www.gorillawalker.com/select-editions-reader-s-digest-condensed-books-volume-5-2004.pdf
    • http://www.gorillawalker.com/pooch-caf-2008-day-to-day-calendar.pdf
    • http://www.gorillawalker.com/tempted-a-birthright-novel-2-the-birthright-series-kindle-edition.pdf
    • http://www.gorillawalker.com/treasure-the-trials-of-a-teenage-terror-and-her-mom.pdf
    • http://www.gorillawalker.com/sinopah-the-indian-boy.pdf
    • http://www.gorillawalker.com/an-introduction-to-language.pdf
    • http://www.gorillawalker.com/clinical-med-occupat-physician-occupational-safety-and-health.pdf
    • http://www.gorillawalker.com/dun-bradstreet-regional-directories-east-of-england.pdf
    • http://www.gorillawalker.com/atlas-of-pediatric-ophthalmology-and-strabismus-surgery-vascular-anatomy-physiology.pdf
    • http://www.gorillawalker.com/smart-grid-planning-and-implementation.pdf
    • http://www.gorillawalker.com/middle-eastern-cooking-foods-of-the-world-series.pdf
    • http://www.gorillawalker.com/2-corinthians-volume-40-second-edition-word-biblical-commentary.pdf
    • http://www.gorillawalker.com/judo-get-going-martial-arts.pdf
    • http://www.gorillawalker.com/mormonism-a-life-under-false-pretenses.pdf
    • http://www.gorillawalker.com/strategies-for-theory-construction-in-nursing-5th-fifth-edition-paperback.pdf
    • http://www.gorillawalker.com/snooke-demon-warriors-2-siren-publishing-everlasting-classic.pdf
    • http://www.gorillawalker.com/suedehead.pdf
    • http://www.gorillawalker.com/complete-idiot-s-guide-to-the-art-of-songwriting-the.pdf
    • http://www.gorillawalker.com/armchair-reader-wild-wacky-weddings.pdf
    • http://www.gorillawalker.com/home-fires-burning-boxed-set-of-twelve-taboo-xxx-stories.pdf
    • http://www.gorillawalker.com/the-charcoal-foundry-build-your-own-metal-working-shop-from.pdf
    • http://www.gorillawalker.com/imaginary-poets.pdf
    • http://www.gorillawalker.com/age-and-dancing-older-people-and-community-dance-practice-paperback.pdf
    • http://www.gorillawalker.com/fire-from-the-rock.pdf
    • http://www.gorillawalker.com/all-the-best-in-switzerland.pdf
    • http://www.gorillawalker.com/one-small-child.pdf
    • http://www.gorillawalker.com/autism-and-reading-comprehension-ready-to-use-lessons-for-teachers.pdf
    • http://www.gorillawalker.com/c-leste-maisler-la-l-gende-episode-3-french-edition.pdf
    • http://www.gorillawalker.com/india-major-world-nations.pdf
    • http://www.gorillawalker.com/rescuers-the-world-s-top-antiterrorism-units.pdf
    • http://www.gorillawalker.com/bon-voyage-level-3-writing-activities-workbook-glencoe-french.pdf
    • http://www.gorillawalker.com/scrum-the-art-of-doing-twice-the-work-in-half.pdf
    • http://www.gorillawalker.com/sqa-past-papers-in-standard-grade-general-chemistry-1999-2003.pdf
    • http://www.gorillawalker.com/volvo-v70-s80-service-and-repair-manual.pdf
    • http://www.gorillawalker.com/the-first-year-hepatitis-c-an-essential-guide-for-the.pdf
    • http://www.gorillawalker.com/toussaint-l-ouverture-world-leaders-past-present.pdf
    • http://www.gorillawalker.com/degen-space-pirates-book-7.pdf
    • http://www.gorillawalker.com/coastal-engineering-studies-in-support-of-virginia-beach-virginia-beach.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0000126b.bin
bd9ce1edb70b8d48ef0525b822df65591192a6d58bb584594027012d3aed0107		 pdf-embedded-script PDF decompressed stream script payload at offset 0x126B 13481 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.