PDF malware analysis — malicious · d880653208df2218

MALICIOUS

PDF

41.3 KB Created: 2012-09-15 11:30:15 +04:00 Authoring application: Wordpress.com (via mPDF 5.0)

MD5: 0cc1429686a1443f0f7555a725ed2450 SHA-1: 16f29ad7e96616a91a199d49494e893f9ef85c31 SHA-256: d880653208df22187b320ca888ad2e179282197b9a6517cb47f8b04885b9880c

66 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF document contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier strongly flags this PDF as malicious. The extracted JavaScript file, 'javascript_obj0029_000.js', shows signs of obfuscation and is likely responsible for the malicious behavior, such as downloading additional payloads. The presence of JavaScript actions and streams points towards an attempt to execute code directly from the PDF.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 3

Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0029_000.js` `cd6097ae9725eedeb8d68162b4d969180785ce4cb6006439670b9637b33de890`	pdf-javascript-stream	PDF /JS object 29 at offset 0x9CE9	136 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
`stream_003_off000014ba.bin` `4056ebfe3787e8014d280a1c1758194f27ba9894cd4d5103b3e304c7c49fa759`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x14BA	17832 bytes
`font_01_sfnt_off00004300.bin` `a8ed3909966b10c026f46212f55dce68c94667ce1ac039797d3ebfa1d644dacf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4300	17892 bytes
`font_02_sfnt_off00007140.bin` `4ee4e439b16220e78b319060a3d86ba95cd4b8614522dd4fa1d4df274793c516`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7140	18720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.