Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca71c2eed21ee7c8…

MALICIOUS

PDF

1002.6 KB Created: 2002-02-26 08:23:59 -08:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0.5 (Windows))
MD5: e162554c5bc23a77fa0ff3926acd2a9b SHA-1: 4d28878b490d7fc6314d1863d2ed21340a9b2e95 SHA-256: ca71c2eed21ee7c8b4c6a78eade76ddf6fb4d210106ba1eefa1726ed42b7f101
514 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The PDF file contains JavaScript that triggers a launch action, executing cmd.exe. This command is used to execute an embedded Windows executable payload, which is masqueraded as 'Excel.pdf'. The embedded executable was detected by ClamAV as Win.Trojan.Swrort-5710536-0. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 12

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\Excel.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
Excel.pdf
98e9b8bc118bba411d523dd3d24b95427a47d003a5781e214d3119e168194ec7		 pdf-embedded-file PDF EmbeddedFile object 75 at offset 0xF1987 61440 bytes
Detection
ClamAV: Win.Trojan.Swrort-5710536-0
Obfuscation or payload: unlikely
javascript_obj0076_000.js
c7366eff30dd5f64962e708683d232e3675392b5519add6e2ad18bbc95e3090b		 pdf-javascript-stream PDF /JS object 76 at offset 0xFA61A 54 bytes
stream_007_off0001ad1d.bin
e323e744dbcc08fabbfeadfba1a9f1a11dd0260b874a8c2c924769fb68dbc70c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1AD1D 627966 bytes
stream_009_off0003281b.bin
dd1e8dd8fcd0b6ff3b4293218d8b55bb706bdba3c53eafde1d2bce1a988db420		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3281B 557598 bytes
stream_011_off0004acb4.bin
0358bc8bcdda0d8fcfb12f576d24dd5155e179ee1d82ad817d61c0e7ffc12771		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4ACB4 687351 bytes
stream_014_off0006793d.bin
c87feec872a0fb4d2610618f3c768026756de6da9317a13e8b16fecd9a900669		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6793D 712800 bytes
stream_016_off000863a5.bin
619b8e2626b835452f067cdf915595f50c8af27b359b6e4731f86414f9c1fc3d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x863A5 1136142 bytes
stream_020_off000b9b3f.bin
354675386af81e85a1e8b1d9220c6e65d4e28c0e712337e4b77af3589b5fa6be		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB9B3F 1147608 bytes
stream_025_off000ef207.bin
9d6fd9424d822348ab9c429b909499c9d8061805feb9e4dee3cb4598be607bc0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF207 10576 bytes
icc_00_off0001176b.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x1176B 3144 bytes
font_00_sfnt_off00001cd2.bin
e198b6686d50b997833a2fed538c8a46060519353eff2f72384f18cc1264cb9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CD2 58228 bytes
font_01_sfnt_off000ed5b3.bin
e4fa96611789c05bd2d4c886fbf924f355144ffabcc1d7e96fb024febfa54a20		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED5B3 10628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.