Swrort — PDF malware analysis

Static analysis result for SHA-256 e46f42d850fe48d2…

MALICIOUS

PDF

44.6 KB Authoring application: Aspose Ltd. (via Aspose.PDF for .NET 21.4.0) First seen: 2021-07-02
MD5: 5b6e5ce13512eb066c374c3686844fb4 SHA-1: 8b1b8d46126667af19e112cfef37aa11855563c3 SHA-256: e46f42d850fe48d25dd4b247dfbcc41dd500086ed906af3a5d4448fce926e348
256 Risk Score

Malware Insights

Swrort · confidence 95%

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript and a critical heuristic firing indicates an embedded Windows executable payload. ClamAV identifies the embedded payload as Win.Trojan.Swrort-5710536-0. The presence of JavaScript and an embedded executable strongly suggests an attack pattern involving spearphishing attachment, leading to client execution of the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 7

  • ClamAV: Win.Trojan.Swrort-5710536-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Swrort-5710536-0
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.zeustech.net/ In PDF document text
    • http://]hostname[:port]/pathIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://www.apache.org/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000294.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x294 73802 bytes
SHA-256: e19b8be1b21c066d60725e550f8455f824065abbf1b43f7b2fe4fb338b241ffc
Detection
ClamAV: Win.Trojan.Swrort-5710536-0
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=stream_001_off00000294.bin; kind=decompressed-pdf-stream Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_PUSH_STRING, SC_STR_GETPROCADDRESS Static shellcode analysis recovered API/import strings: kernel32.dll, advapi32.dll, KERNEL32.DLL, ADVAPI32.DLL, LoadLibraryA, GetProcAddress

Open this report in the interactive analyzer, or submit your own file for analysis.