Malicious PDF — malware analysis report

Static analysis result for SHA-256 e34b2e174c805924…

MALICIOUS

PDF

575.6 KB Created: 2010-09-21 21:42:20 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))
MD5: 63703ef874ca6e197823e51b37f66940 SHA-1: 7b8b80dc23c853627d149da1d29c6dc018922981 SHA-256: e34b2e174c8059248c927d735f1f29a28c8d11e25b5c6b668e6a4472d5048b5f
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a hidden external HTML iframe, indicating an attempt to redirect the user to a remote resource. ClamAV identified the file as Html.Spyware.IMG-7. The embedded URL points to an unknown reputation site, which is likely the destination for the iframe redirection. The specific exploit used is unclear due to the lack of script content, but the presence of the iframe and the ClamAV signature suggest a drive-by download or redirection attack.

Heuristics 3

  • ClamAV: Html.Spyware.IMG-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Html.Spyware.IMG-7
  • PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME
    PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.codeforum.cn/free/max1.htm
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/exif/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://purl.org/dc/elements/1.1/
    • http://www.iec.ch

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000b7a7.bin
a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB7A7 264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.