Malicious PDF — malware analysis report

Static analysis result for SHA-256 de50609dd6af3496…

MALICIOUS

PDF

194.8 KB Created: 2010-02-07 22:10:13 +01:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx (0.6))
MD5: e8372f1de8dc0f65c3b11d988fb7e7d3 SHA-1: 5d88603b5686ce7808c48541f03cb31440864b1a SHA-256: de50609dd6af34965c39bb8509dfd7f6608910191d005f7cca8e448aa84c8b5a
372 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file exhibits critical heuristic firings indicating it contains a launch action for cmd.exe, which is designed to execute an embedded script. The script is likely a downloader, as suggested by the 'PDF_LAUNCH_COMMAND' and 'PDF_EMBEDDED_SCRIPT_PAYLOAD' heuristics. The presence of 'Win.Trojan.Dropper-134' from ClamAV further supports its malicious nature. The embedded URL 'http://www.foo.be/' is a potential distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 9

  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/c echo Dim BinaryStream > vbs1.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • ClamAV: Win.Trojan.Dropper-134 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Dropper-134
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.foo.be/
    • http://www.gitorious.org/~adulau

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0000ddf7.bin
7538a7a883882c3acc04fad662684c8f6ee6707ed9def558f028f3c722d11e1a		 pdf-embedded-script PDF decompressed stream script payload at offset 0xDDF7 199441 bytes
Detection
ClamAV: Win.Trojan.Dropper-134
Obfuscation or payload: likely
Carved artifact contains 2 shell/COM execution token(s). Carved artifact contains 2 long base64-like blob(s).
font_00_cff_off00003d8a.bin
09e18e495b68106a55aace3f441183e73b28de0f6fbcb0af0b76d08e38de00da		 pdf-font-stream PDF embedded font (cff) at offset 0x3D8A 15636 bytes
font_01_sfnt_off00007386.bin
1bbf8d898c7de34b2ed1bfb68d2725a06e3c5e09957aee601794b4fe88adb9f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7386 13054 bytes
font_02_cff_off00009b0d.bin
81cd2ec160f0dbbfecf3a7282aa50fb69c8be6a3e42aa5a6d27c573cc7517a2e		 pdf-font-stream PDF embedded font (cff) at offset 0x9B0D 7529 bytes
font_03_cff_off0000b8d9.bin
19f70b70255abac1a93513d95c8ae661c9f9d2f99400a22c24727869e919e5ad		 pdf-font-stream PDF embedded font (cff) at offset 0xB8D9 7369 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.