Malicious PDF — malware analysis report

Static analysis result for SHA-256 b458a8be61992c52…

MALICIOUS

PDF

3.56 MB Created: 2018-05-29 16:38:09 UTC Authoring application: Pragmatic Bookshelf (via XEP 4.19 build 20110304) First seen: 2019-05-31
MD5: 1dd0214fdc2e0ffd4258cf668d4fd865 SHA-1: 73d1a2395d2bbd67069a90ca2fe76fa0e88f43e6 SHA-256: b458a8be61992c5225d71f5149704e2bae7f094662351fcf68afb77bb29613ae
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains multiple heuristics indicating malicious intent, including PDF_REPEATED_PAYLOAD_LINK_LURE and SE_ADVANCE_FEE_SCAM_LURE. The document body appears to be legitimate technical content, but the presence of invisible and repeated links suggests a deceptive tactic. The critical heuristic points to a payload link to 'http://media.pragprog.com/titles/es6tips/code/variables/const/const.js', which is likely the intended download target. The PDF also contains embedded JavaScript, though its specific actions are not detailed here.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8702

Heuristics 5

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/jsmapr1/simplifying-js In PDF document text
    • http://thejoemorgan.comIn PDF document text
    • https://github.com/tc39/proposal-object-values-entriesIn PDF document text
    • https://github.com/tc39/Array.prototype.includes/In PDF document text
    • https://github.com/tc39/proposal-object-rest-spreadIn PDF document text
    • https://github.com/facebook/react/pull/7232#issuecomment-231516712In PDF document text
    • https://github.com/airbnb/javascript/issues/851In PDF document text
    • https://flow.orgIn PDF document text
    • https://${getProvider()}/${image}?width=${parseInt(widthIn PDF document text
    • https://assets.foo.com/${path}`In PDF document text
    • https://assets.foo.com/acme/bar.pngIn PDF document text
    • https://mochajs.orgIn PDF document text
    • http://2ality.com/2017/11/currying-in-js.htmlIn PDF document text
    • http://ryanmorr.com/understanding-scope-and-context-in-javascript/In PDF document text
    • https://github.com/getify/You-Dont-Know-JS/blob/master/this%20%26%20object%20prototypes/ch4.mdIn PDF document text
    • https://github.com/getify/You-Dont-Know-JS/blob/master/this%20%26%20object%20prototypes/In PDF document text
    • https://github.com/typicode/json-serverIn PDF document text
    • https://lodash.com/In PDF document text
    • https://github.com/facebookincubator/create-react-appIn PDF document text
    • https://rollupjs.org/In PDF document text
    • https://github.com/getify/You-Dont-Know-JS/blob/master/this%20%26%20object%20prototypes/ch2.md#explicit-bindingIn PDF document text
    • http://dejavu.sourceforge.netFontsIn PDF document text
    • https://pragprog.comPDF link annotation
    • http://pragprog.com/titles/es6tips/errata/addIn PDF document text
    • http://forums.pragprog.com/forums/es6tipsIn PDF document text
    • https://pragprog.com/book/es6tips/simplifying-javascriptIn PDF document text
    • https://twitter.com/joesmorganIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/const/const.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/let/problem.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/let/let.spec.jsIn PDF document text
    • https://pragprog.com/titles/es6tips/source_codeIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/let/let.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/let/const.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/let/declaration.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/scope/scope.htmlIn PDF document text
    • https://developer.mozilla.org/en-US/docs/Glossary/HoistingIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/scope/problem.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/scope/curry.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/scope/scope.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/literals/problem.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/variables/literals/literals.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/arrays/arrays.jsIn PDF document text
    • https://stackoverflow.com/questions/34955787/is-a-javascript-array-order-guaranteedIn PDF document text
    • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Iterators_and_Generators#Built-in_iterablesIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/includes/problem.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/includes/greater.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/includes/includes.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/spread/problem.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/spread/splice.jsIn PDF document text
    • http://media.pragprog.com/titles/es6tips/code/arrays/spread/slice.jsIn PDF document text
    +205 more URL(s)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_174_off000f07c8.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF07C8 5225 bytes
SHA-256: 8cc1f3438165b95cdf5ad591865b0f06490b3eca1e41fed694bfd0b3e52d73c6
icc_00_off0030127e.icc pdf-icc-profile PDF ICC profile at offset 0x30127E 2008 bytes
SHA-256: 0fb37c4328cacebb547210723e15a9fe040ef5a17e5b496e993ca68db0126a88
icc_01_off0030450f.icc pdf-icc-profile PDF ICC profile at offset 0x30450F 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00305a29.bin pdf-font-stream PDF embedded font (cff) at offset 0x305A29 21063 bytes
SHA-256: 5941493b76ef78501b3489ae97e0be2afe734f556b40be7582aead28ed21b57c
font_02_cff_off0030be85.bin pdf-font-stream PDF embedded font (cff) at offset 0x30BE85 21831 bytes
SHA-256: 03014473b7c091ecf7a33f5ff298fa92922e90ed3610b444b443d6a1a37eb9be
font_04_cff_off00311654.bin pdf-font-stream PDF embedded font (cff) at offset 0x311654 19121 bytes
SHA-256: 333f5980048d8d1367b097efaa7825b777968eb3eb8837c119b0930ae8f59d18
font_05_sfnt_off00313e66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x313E66 180922 bytes
SHA-256: 339c1a0c1a9d252b1df149be54dc367aeb4df045e0df5128121577ff1a4b2fe8
font_06_sfnt_off00322b88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x322B88 138674 bytes
SHA-256: 6c906174f3b31117665b4c2579d6d105f67e8e074d439185975e1896e4bcc905
font_07_sfnt_off0032f284.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32F284 91706 bytes
SHA-256: cb6d9bdb741d62568a1dd17e20928f17ec75788438629282530fdf83f622a461
font_08_sfnt_off00339128.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x339128 68770 bytes
SHA-256: 61bc40248b7d330a9cc52be159e89135132365eca20e593546f9f248a8247839
font_09_sfnt_off00340278.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x340278 65914 bytes
SHA-256: fb26259dfa79d677cc0646b0fa5d90f982bdc9ab96f8430aee58d0293e9e2772
font_10_cff_off00347688.bin pdf-font-stream PDF embedded font (cff) at offset 0x347688 53248 bytes
SHA-256: babb34dfa0ec9602f5a7acc6f1c8e7f1ab9033a5d64edcb4abc787fdcb2a9fca
font_11_cff_off0034c2fe.bin pdf-font-stream PDF embedded font (cff) at offset 0x34C2FE 54095 bytes
SHA-256: 27eff174eac3079d72cea1dfda0da8ef72d89303acb5f9b75d7c2adb934886a7
font_13_cff_off00356044.bin pdf-font-stream PDF embedded font (cff) at offset 0x356044 55012 bytes
SHA-256: c8ffe5a62d0bbeea1b896e868a066c6fce920c4fb300e2657d3bfc23e2869ed6
font_15_cff_off0035fafe.bin pdf-font-stream PDF embedded font (cff) at offset 0x35FAFE 61547 bytes
SHA-256: f79ebdede1bdfb8a7a6691e733fa93cf0dcf1ab05d8cc16c0061cb8d4cd3c5ef
font_16_cff_off003644f8.bin pdf-font-stream PDF embedded font (cff) at offset 0x3644F8 28623 bytes
SHA-256: bd0a60dbe466cb7d902421936750c1e734b3431852d4e73a82d488300a00b46f

Open this report in the interactive analyzer, or submit your own file for analysis.