Malicious PDF — malware analysis report

Static analysis result for SHA-256 c77e6f86e6d1849b…

MALICIOUS

PDF

3.29 MB Created: 2017-11-14 22:41:43 +03:00 Authoring application: Microsoft® Word 2013
MD5: 2379a7c51ec6e45def1d273fcde1252c SHA-1: d9d773c4880c0ff43a90bacd475eb8d2472080f1 SHA-256: c77e6f86e6d1849bd1ef4bd19896bce68a4ece0e86d7e75971e2bec9ee0424d0
360 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 Command and Scripting Interpreter: JavaScript T1566.001 Phishing: Spearphishing Attachment

The PDF contains a launch action that executes cmd.exe, which in turn appears to be designed to download and execute a script. This is further supported by heuristics indicating an embedded script payload and a WScript downloader. The document body's language suggests a payment redirection lure, aiming to deceive the user into performing a financial transaction.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 9

  • Adobe Reader Launch action VBS dropper command chain critical CVE likely CVE_2010_1240_LAUNCH_VBS_DROPPER
    PDF uses a CVE-2010-1240-style Launch action: cmd.exe is invoked from /Launch and builds a VBS stage that uses ADODB.Stream, MSXML2.XMLHTTP, or FileSystemObject to write or execute a payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • PDF JavaScript WScript downloader high PDF_JS_WSCRIPT_DOWNLOADER
    Decoded PDF JavaScript reconstructs a Windows Script Host COM downloader using WScript.CreateObject plus XMLHTTP/ADODB.Stream style download, write, and run behavior. This is commodity payload delivery rather than a specific PDF parser CVE trigger.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://universa.io
    • http://access.universa.io
    • http://bit.ly/2fkELHm
    • http://en.wikipedia.org/wiki/MIT_License
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@
    • http://www.microsoft.com/Typography/0
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoft
    • http://www.microsoft.com/typography/fonts/default.aspx
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00007116.bin
3ae72603aa8ccc31c772c8eb73c792a38310815da09e10872d2cf032a5ced50b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7116 246246 bytes
stream_018_off0006f62f.bin
c62da33cf0c666e726235a7f867f2f8d241d9299941a722107b6fdbd55f6a618		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F62F 4194304 bytes
stream_036_off00108a89.bin
38115f104a2be287d273f27b39fd65875cd50bdf8fc0bb5b5847c59477987bd6		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x108A89 325488 bytes
stream_039_off00134235.bin
a764fce7f04b3c8efbb4281007f70394214dcfcee7b0ed4fa1dc5cd8dfd4fefb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x134235 366360 bytes
embedded_pdf_script_001660f8.bin
8a63e15b3e80771e77914d5807ad3497a88c834b789e55a7ccab717ee9c19c15		 pdf-embedded-script PDF decompressed stream script payload at offset 0x1660F8 3451026 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.