Malicious PDF — malware analysis report

Static analysis result for SHA-256 c820be2620ea1233…

MALICIOUS

PDF

553.6 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: e0191a1270ca0e37efa71643cb13ff5c SHA-1: 3e0cd4f4d989698d05418a44e246238cf7e8ea43 SHA-256: c820be2620ea1233b11ad4dd7c2484197e5aef21302435382ff01fd10568d7a2
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded objects and a remote GoTo action, indicating an attempt to redirect the user to malicious content or download a secondary payload. The ML classifier strongly flagged this PDF as malicious. The presence of embedded files and suspicious PDF structures suggests a drive-by download attack or exploitation of a PDF vulnerability to execute arbitrary code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cosmos_saturn_916.pdf
97ba051c4f1e47b63564ca421caef9649edf62d2bf020ba900bf66b7ea834ec4		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 224429 bytes
cosmos_saturn_916_1.pdf
eb4a5004af9598fbc42555af8e9fe17f20d87c8aa8ccfcd5e23c4bb8cf071051		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 310932 bytes
cosmos_saturn_916_2.pdf
a6151c0c1ff1fc0ee444b74f8ee2f3a80a89a8ec891bb96e3ca5299b8f7d4b0b		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 397394 bytes
stream_019_off0001a020.bin
5fc1731e98c82a0c8522d2db38b3570cf8623ee628f8548f83596b862d66f96b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A020 483922 bytes
objstm_0121_00.bin
967c2bb2796888a6d2b2eec5d6f3305f7dcfec4a00bde20982223a85f60f89e2		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.