PDF malware analysis — malicious · cbc162ec42a8a74f

MALICIOUS

PDF

14.0 KB Created: 2014-04-16 18:41:29 +02:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.14)

MD5: 9e9055f06ddc2482eaa780d3ad8e1ae0 SHA-1: 80749055cd548710abf3f8c518bd6216ab891ef0 SHA-256: cbc162ec42a8a74fddbdf07180a3ca4aefb6e02d67ead996ea9a1c1259d34909

346 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1553.005 Mark-of-the-Web Bypass T1027.004 Obfuscated Files or Information: Steganography T1140 Deobfuscate/Decode Files or Information T1059.001 PowerShell

The PDF file contains embedded JavaScript that utilizes unescape() for obfuscation, a common technique for hiding malicious code. The critical heuristic 'PDF_HIDDEN_ZIP_EXECUTABLE_PAYLOAD' indicates a hidden ZIP archive within a PDF stream, which was confirmed to contain the EICAR test file. The 'CVE_2007_5659' heuristic further points to a known vulnerability exploitation. The presence of the EICAR test file and the exploitation of PDF vulnerabilities strongly suggest a malicious intent to deliver a payload.

Heuristics 11

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits.
Hidden ZIP payload with executable entries inside PDF stream critical PDF_HIDDEN_ZIP_EXECUTABLE_PAYLOAD

PDF stream bytes contain an embedded ZIP archive whose local headers name executable payload files. This is not a normal PDF attachment (/EmbeddedFile); it hides Windows payloads inside an ordinary stream, a strong malware-loader or smuggling pattern.
ClamAV: Eicar-Signature critical CLAMAV_DETECTION

ClamAV detected this file as malware: Eicar-Signature
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OpenAction trigger high PDF_OPENACTION

PDF has an /OpenAction — code runs automatically when opened
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.corkami.com

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`hello.zip` `47cde5183f6c12ccb8b36ee5deffc5b3c7600d2ea91c20d0bece8788977eaa5e`	pdf-embedded-file	PDF EmbeddedFile object 6 at offset 0x3AF	330 bytes
Detection ClamAV: Eicar-Test-Signature Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.