PDF malware analysis — malicious · b225478bb76bde6a

MALICIOUS

PDF

164.3 KB Authoring application: Python PDF Library 055 http072057057pybrary056net057pyPdf057

MD5: b9a44db5374689d494dfb6af373ce5a1 SHA-1: c34f45de712b49f770bda7f32277a71e63a8f035 SHA-256: b225478bb76bde6ae2fbbaf6db2a797cdf426d207086014dae914b43bbe68efb

124 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF file contains embedded JavaScript and rich media (Flash) content, indicating an attempt to exploit vulnerabilities. A secondary embedded PDF was also detected, which itself contains suspicious static findings including JavaScript and embedded files. This suggests a multi-stage attack designed to deliver a payload. The embedded URL, while benign, is noted as part of the document's structure.

Heuristics 6

Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://adobe.com/AS3/2006/builtin

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`pushpro.swf` `3f8e0576de2e9af38360a78e3ca79d41fb9060cefdb628cb69589ea03d1d3358`	pdf-embedded-file	PDF EmbeddedFile object 7 at offset 0xB4F	772 bytes
`polyglot_child_pdf_off000278c3.pdf` `a83bfb9919532c6181eacb729fe445cf4d147f042db955d25812f2efc6d038df`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x278C3	6297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.