NanoCore — PDF malware analysis

Static analysis result for SHA-256 d070b82b93542fa7…

MALICIOUS

PDF

1.32 MB
MD5: e74053a736a96489723387ed3a4af7f3 SHA-1: fd9adaa43f3e95a9651c113bf275e413860b2c9d SHA-256: d070b82b93542fa7e80cc5809fe9c21a658c29dfa00dc9eb609d77aee8eb3cfa
144 Risk Score

Malware Insights

NanoCore · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF file contains an embedded Windows executable payload. Static analysis identified this payload as Win.Trojan.NanoCore-9852758-0, a known Remote Access Trojan. The presence of the executable and the ClamAV detection strongly indicate a malicious intent to deliver and execute malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0035

Heuristics 5

  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_024_off00114ce4.bin
7a88fcd386c99fa5fae8fc5b0d36e6ecc296d024fb219bc6f9358eddf25ebe60		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x114CE4 40480 bytes
embedded_pdf_0011f003.exe
892852cf0a0fdffbdad8b56b00b81d09fe034e2269a9083194ca22acd17b4384		 embedded-pe PDF decompressed stream PE payload at offset 0x11F003 207862 bytes
Detection
ClamAV: Win.Trojan.NanoCore-9852758-0
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
font_01_sfnt_off00118ea1.bin
0e6f7463466fed87efc13cdee4b86450c86aaaa4ad4b60be4fcb5ae94235c0da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118EA1 36780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.