Malicious PDF — malware analysis report

Static analysis result for SHA-256 c03cea3071ec375a…

MALICIOUS

PDF

590.8 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 1e03fd79afed05adb0ea1a6967b521f2 SHA-1: 16eebe5685a44569c698a8b16dcec150201a8518 SHA-256: c03cea3071ec375a650ed7c86b93f8ade0ccf9194d3d49ef17de00e4cee4c5d7
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits malicious behavior through embedded malicious PDF files and suspicious remote GoTo actions, as indicated by critical heuristic firings. The ML classifier also flagged this PDF as malicious with a high probability. While no scripts were extracted, the presence of embedded malicious content suggests a delivery mechanism for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cigar_uranus_6.pdf
753afd2e1dfd4b7194ee8f732bdd38eaa3dedebd4e82fbdd330ea981d4cc0696		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 262510 bytes
cigar_uranus_6_1.pdf
d3fd58d7aa976bc2403819fe18906ade5328b5badf98b3ed569fe98d6148d6f8		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 348978 bytes
cigar_uranus_6_2.pdf
a129b03c1d4842720e39f3d38251a953e10647a990bb698f1928d8851eb07b2c		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E5 435507 bytes
stream_019_off0001a01e.bin
8d905bfa0d84bd4a9a46d82dc45caef4a3b27805fd7bf6cf6b2821b5175e2e38		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01E 522062 bytes
objstm_0121_00.bin
7e14982f78c9c5c481f323f04e0027e67634f410ad1f9d21f8aae492ad50c4a4		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1108 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.