Malicious PDF — malware analysis report

Static analysis result for SHA-256 d36882c5ff701277…

MALICIOUS

PDF

2.79 MB Created: 2016-07-29 07:41:57 -07:00 First seen: 2020-12-25
MD5: 8d5a2015c5dcb8ce0f331178788db9a8 SHA-1: 59d84487efdbaa1eb129e8eace88edbec127d449 SHA-256: d36882c5ff70127784cb24d0e351ae8faa5ca99c224198e4d6a63bed3a21c365
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains an embedded Windows executable payload, indicated by the 'PDF_EMBEDDED_PE_PAYLOAD' heuristic. The presence of XFA forms and embedded streams suggests an attempt to exploit PDF vulnerabilities for initial execution. The extracted executable is likely the primary malicious component, with the PDF serving as a delivery mechanism.

Machine Learning

  • Nyx PDF Classifier clean score 0.0064

Heuristics 6

  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.usertrust.com0 In PDF document text
    • https://secure.comodo.net/CPS0FIn PDF document text
    • http://ocsp.comodoca.com0In PDF document text
    • http://ts-ocsp.ws.symantec.com07In PDF document text
    • http://ocsp.thawte.com0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineIn PDF document text
    • http://schemas.microsoft.com/SMI/2005/WindowsSettingsIn PDF document text
    • http://www.chiark.greenend.org.uk/~sgtatham/putty/In PDF document text
    • http://crl.usertrust.com/AddTrustExternalCARoot.crl05In PDF document text
    • http://crl.comodoca.com/COMODOSHA256CodeSigningCA.crl0wIn PDF document text
    • http://crt.comodoca.com/COMODOSHA256CodeSigningCA.crt0$In PDF document text
    • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0In PDF document text
    • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(In PDF document text
    • http://crl.thawte.com/ThawteTimestampingCA.crl0In PDF document text
    • http://www.chiark.greenend.org.uk/~sgtatham/putty/0In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off000016fe.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16FE 6078 bytes
SHA-256: dead0aa6606def69e1198222a2b593e6894ce3a864dcab8c2eaf83d59633c768
stream_018_off000107dd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x107DD 2570096 bytes
SHA-256: 96b4d770c86ea397d56bec1c6a015c1559ecbc8e4a436cd48cf2bc32e258a977
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=stream_018_off000107dd.bin; kind=decompressed-pdf-stream Carved artifact entropy is 7.94, consistent with packed or encrypted content.
stream_019_off0027ea12.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x27EA12 531368 bytes
SHA-256: 9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=stream_019_off0027ea12.bin; kind=decompressed-pdf-stream

Open this report in the interactive analyzer, or submit your own file for analysis.