PDF malware analysis — malicious · b87f75b6d989b847

MALICIOUS

PDF

951.6 KB Created: 2010-06-19 22:35:43 +08:00 Authoring application: 376377000P000D000F000C000r000e000a000t000o000r000 000V000e000r000s000i000o000n000 0001000.0000000.0001 (via GPL Ghostscript 8.71)

MD5: 4fb84c27002a315a940b923dc24a538c SHA-1: a746e87b7acd9670e9938ee2e48285b167b9a52d SHA-256: b87f75b6d989b847ba3537df51d2cd5daa72ff4aef91453b12a286bcf5b2ac8e

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains a critical heuristic firing for a launch action targeting cmd.exe, indicating an attempt to execute commands. The embedded script payload, though truncated, appears to be constructing a VBScript file named 'decrypted_process_done1.vbs' and potentially a second-stage executable 'decrypted_process_done.exe'. This suggests the document is a lure designed to initiate a multi-stage infection process.

Heuristics 5

Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > decrypted_process_done1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/iX/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0000362a.bin` `2b9ec7bac71af9fdd6ae68819670c1d58dc14511ff86236709e3c472a7c79833`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x362A	109 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.