PDF malware analysis — malicious · c3bd336dc25affdc

MALICIOUS

PDF

MD5: ce96e7bdea24e16c1c859cd6d5156ff2 SHA-1: d1e59247762e84e6005e4ca60e703f68cd2318e9 SHA-256: c3bd336dc25affdc669f1c220a3572e446fb8274a0cea389fc8802a1180de52b

348 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link

The sample is a PDF document that leverages CVE-2017-0199, a known vulnerability in Microsoft Office, to download and execute a secondary payload. The embedded JavaScript and OLE object data, along with the critical heuristic firings for CVE-2017-0199 and OLE auto-linking, strongly indicate a malicious dropper. The primary IOC is the URL used to fetch the next stage of the attack.

Heuristics 13

CVE-2017-0199 (OLE2Link / remote URL Moniker) critical CVE likely CVE_2017_0199

RTF contains a URL Moniker OLE link whose decoded target is remote. Office can fetch and process the response through the CVE-2017-0199 OLE2Link attack path, but the server-side content type is not proven statically.
ClamAV: Doc.Dropper.Agent-7127408-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-7127408-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OpenAction trigger high PDF_OPENACTION

PDF has an /OpenAction — code runs automatically when opened
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2003/wordml
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `cc59a615b00e9cb056ad33f908bee6887a07009ec235853f9260dcdaf913a3bf`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x83	5758 bytes
Detection ClamAV: Doc.Dropper.Agent-7127408-0 Obfuscation or payload: likely Carved artifact contains 17 long base64-like blob(s).
`javascript_obj0014_000.js` `4c0efe1f857861f5b71004078c353e10c2b95d2d870bdb93eec9cf2d973b948f`	pdf-javascript-stream	PDF /JS object 14 at offset 0x38EAE	52 bytes
`javascript_obj0003_001.js` `c4c6d99b6a49c4d550266b164d59617ee8e67114f1d0ddc6ef6da1159813fd94`	pdf-javascript-stream	PDF /JS object 3 at offset 0x23B0	108 bytes
`objdata_00_off0000022e.bin` `eeb20da5c057f3ac513e1242cc5467b14808694b5a168828f19f96c5490dd6c2`	rtf-objdata-decoded	RTF \objdata at offset 0x22E	2601 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.