Malicious PDF — malware analysis report

Static analysis result for SHA-256 b597cb5bc7c1a390…

MALICIOUS

PDF

54.0 KB Created: 2011-05-26 13:22:41 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: c07a72c5a81efe7f5b5a7a4001b84b75 SHA-1: 17d43033f23b8454a2bb297c230e5529a6a10b19 SHA-256: b597cb5bc7c1a390cd986c2ea3b24f6f1e38b3b2fc8fcb9b240bb08ca01f18a9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains a critical heuristic firing for the CVE_2008_2551 exploit, indicating it targets a vulnerability in PDF readers. The embedded URL points to a potential executable download. The document body, though heavily obfuscated, contains references to external URLs that are typically used in phishing or malware delivery schemes. The primary attack vector appears to be exploiting a PDF reader vulnerability to download and execute a secondary payload.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=1027286
    • http://www.presstv.ir/Persian.aspx?id=8820
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000198f.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x198F 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.