PDF malware analysis — malicious · ddbeb80318164464

MALICIOUS

PDF

304.4 KB Created: 2011-04-22 21:30:39 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))

MD5: f4afc6b7c295d5814de291bc1bdcfafd SHA-1: 36fa3e91c70a5e1f0ff98caee3b7b19cbfc51fb7 SHA-256: ddbeb80318164464330269582b93c3202bdf7118a16eaef1d89656940e3685e3

60 Risk Score

Malware Insights

MITRE ATT&CK

T1204.001 Malicious Link

The critical heuristic firing for CVE_2008_2551 indicates the file attempts to exploit this vulnerability. The embedded URL http://artisanballoonz.com/system/system.exe is likely the download location for the secondary payload. The PDF structure itself does not contain readable content, but the exploit and URL are strong indicators of malicious intent.

Heuristics 2

C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551

PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://artisanballoonz.com/system/system.exe
- http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_013_off00002847.bin` `80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2847	73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.