Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf31aa18b690894c…

MALICIOUS

PDF

10.53 MB Created: 2003-07-30 13:21:32 UTC Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2021-09-16
MD5: cbc3bd1c1d5d3bdc10ea0cfc9c487fda SHA-1: 6459d3f92edf30ee1ba8b69aaea260347bfe0276 SHA-256: cf31aa18b690894c45382ef3321ff3106541906c7acb2290e61b3f009e4c4a7e
440 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains JavaScript that utilizes the `exportDataObject` function, which is known to be used for dropping embedded files. This is paired with a critical PDF_LAUNCH heuristic indicating an attempt to execute `cmd.exe` with parameters that suggest it will execute the dropped file, likely a second-stage payload. The embedded artifact `s7-300_IHB_f.pdf` was identified as a Windows executable, confirming the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 13

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\s7-300_IHB_f.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sitrain.com In PDF document text
    • http://www.ad.siemens.dIn PDF document text
    • http://www.sitrain.com)/S/URIIn PDF document text
    • http://www.siemens.com/automation/partnerPDF link annotation
    • http://www.siemens.com/automation/service&supportIn PDF document text
    • http://www.ad.siemens.de/csIn PDF document text
    • http://www.ad.siemens.de/csinfoIn PDF document text
    • http://www.ad.siemens.de/csie/gsdIn PDF document text
    • http://www.ad.siemens.de/simaticcsIn PDF document text
    • http://www.siemens.com/automation/partner)/S/URIIn PDF document text
    • http://www.siemens.com/automation/service&support)/S/URIIn PDF document text
    • http://www.ad.siemens.de/csinfo)/S/URIIn PDF document text
    • http://www.ad.siemens.de/csi/gsd)/S/URIIn PDF document text
    • http://www.ad.siemens.de/simatic-cs)/S/URIIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • https://www.verisign.com/repository/RPA0In PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0�In PDF document text
    • https://www.verisign.com/CPSIn PDF document text
    • https://www.verisign.com/repository/CPSIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text

Extracted artifacts 24

Files carved from inside the sample during analysis.

FilenameKindSourceSize
s7-300_IHB_f.pdf pdf-embedded-file PDF EmbeddedFile object 3249 at offset 0x37285F 4194304 bytes
SHA-256: 7d0552ca06b4aa4355e41e93ed372bb8b42dba82963604d6b259e633b649fa5a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.53, consistent with packed or encrypted content.
javascript_obj3250_000.js pdf-javascript-stream PDF /JS object 3250 at offset 0xA86F5F 61 bytes
SHA-256: 059a86ad401e344f719e5b98422a9803191f62644a4fb77e85f7d40646ed1174
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "s7-300_IHB_f", nLaunch: 0 });
stream_189_off0022d485.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x22D485 48216 bytes
SHA-256: a88c71a7586f89de839039e8d2730651c8d709dd07be7f1aad2cc0ff8966c55f
stream_200_off00340239.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x340239 52600 bytes
SHA-256: 7ed550bcd1a9cdd0621e378879b80b343fde9d9dbba09315e3db22b26d4c826f
font_00_sfnt_off00003167.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3167 41508 bytes
SHA-256: 44221a82d4104fc693278344ddaf3e9b737d13a21b9139638a49c7e597349dd6
font_01_sfnt_off000090b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x90B9 34536 bytes
SHA-256: 709d4f6e63b33e33d12d17f4703e34957d082a9456e9029ce8f011da9d9ccc43
font_02_sfnt_off0000fb20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB20 36092 bytes
SHA-256: 555a517971693cc94ed6d31ce41e4947e636dc7a0fb743af7117db4dc9908e90
font_03_sfnt_off00014143.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14143 32672 bytes
SHA-256: dc29486741ba9f296c6d2839133be64df3ffe28efbab81510497aae63905b63c
font_04_sfnt_off0001f94c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F94C 20136 bytes
SHA-256: 085222f22d537eed10ce76adc5c9f65c91025d17194687d0127220a7abe7e8b8
font_05_cff_off0005ee38.bin pdf-font-stream PDF embedded font (cff) at offset 0x5EE38 307 bytes
SHA-256: 998508256b0fba60f0bffd02a5195706b2fa3cf9f7cad273e07d71e0c5168533
font_06_cff_off001d2768.bin pdf-font-stream PDF embedded font (cff) at offset 0x1D2768 440 bytes
SHA-256: 286adb5c57aefb0e3a586af64209a52174c8f822626db9c111beaf77cfaffbfc
font_07_sfnt_off002344ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2344AD 37368 bytes
SHA-256: 80f816f8d3f70af2c78e8dc4f4de2c0cbe314bb50e554f7a222979236440420a
font_08_cff_off002437dc.bin pdf-font-stream PDF embedded font (cff) at offset 0x2437DC 177 bytes
SHA-256: 321eae1501b7069d760f400714a2500b70c5bcfe346a258da14ea5d3439f2560
font_10_sfnt_off003481e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3481E1 41664 bytes
SHA-256: a2b39022badcd0b77b3d246dbc798d472bd8bfb9761f40050487898a3e99c8c1
font_11_sfnt_off0034e5cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34E5CC 19296 bytes
SHA-256: 9de7ab383a1178dcc692ba23f17b13d2ff1f896ae05f4acd17369dfea2aa8f49
font_12_sfnt_off003505bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3505BD 30236 bytes
SHA-256: dff8f6c2696dbf7ff7af1996e0123bfd86cd8ea27f098d4db34fa63f923c89e5
font_13_sfnt_off003552a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3552A4 13184 bytes
SHA-256: 2cec5f7247ede257baaa5384c6b9dc0323117bc2ee7f46fd5293183ee6eafbfa
font_14_cff_off003576ed.bin pdf-font-stream PDF embedded font (cff) at offset 0x3576ED 6067 bytes
SHA-256: 9882ff966d656be09e8786ec42cb8296591a2adc343bf925cfbe0db2be691246
font_15_cff_off00358cd1.bin pdf-font-stream PDF embedded font (cff) at offset 0x358CD1 7816 bytes
SHA-256: 84a9ba8405d1d24f16eb25b4ca92a2f3e577ae050679fe5fb7c2888037298422
font_16_cff_off0035ab5e.bin pdf-font-stream PDF embedded font (cff) at offset 0x35AB5E 1513 bytes
SHA-256: 377dba76fc273ce4278053bf62816713f366e7c1047fd54f9a5e4fc12f872f56
font_17_cff_off0035beb9.bin pdf-font-stream PDF embedded font (cff) at offset 0x35BEB9 5478 bytes
SHA-256: 80d8d4cf80a265759e77a0595b94efd71e7f988dd5c11b66c5483ff3bd062ecb
font_18_cff_off0035d3ac.bin pdf-font-stream PDF embedded font (cff) at offset 0x35D3AC 410 bytes
SHA-256: 19dbbf8a0434c6e0695b09b62b31a942f2e4cfcb3c507b2fdff8aa87ce5e46a8
font_19_cff_off0035d9f2.bin pdf-font-stream PDF embedded font (cff) at offset 0x35D9F2 2020 bytes
SHA-256: 9cf182eb18c9d7251835ec55520f50f2baf8b8fb1ce4a800422da3d2a85853c7
font_20_sfnt_off0035eec2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35EEC2 11200 bytes
SHA-256: f583f5dd63a975c6ff227ef846c648b9b13cc9093f78693835a8f83b39183074

Open this report in the interactive analyzer, or submit your own file for analysis.