PDF malware analysis — malicious · b065aa13d8f186d2

MALICIOUS

PDF

MD5: df2d5558dee4312e8f666952c82f24e0 SHA-1: 4bb15f70c8f4b895c3615dcfc890d75c9e556836 SHA-256: b065aa13d8f186d202e79f10fa07954474423d2bf9449bcd3e6bb2c00718d534

82 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution: Malicious File T1059.003 Command and Scripting Interpreter: Windows Command Shell

The PDF contains a URI that attempts to exploit a command interpreter path, indicated by the 'PDF_DANGEROUS_URI_COMMAND' heuristic. This suggests an attempt to execute arbitrary commands, likely to download and run a secondary payload. The 'SE_LOLBIN_RUN_COMMAND' heuristic further supports the presence of command execution instructions within the document.

Heuristics 4

PDF URI references command interpreter path high PDF_DANGEROUS_URI_COMMAND

PDF contains a /URI action whose target uses a mailto/path traversal shape and references a command interpreter or scripting host. This is not a normal web link and matches legacy PDF command execution/dropper lures.
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2007-10/msg00093.html
- http://secdev.zoller.lu
- http://lists.grok.org.uk/full-disclosure-charter.html
- http://www.derkeiler.com/Mailing−Lists/Full−Disclosure/2007−10/msg00093.html
- http://secunia.com/

Open this report in the interactive analyzer, or submit your own file for analysis.