Malicious PDF — malware analysis report

Static analysis result for SHA-256 e63b5e178b1aa545…

MALICIOUS

PDF

554.0 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: f5ad81595607010c6ce5de29de8f8cdc SHA-1: 10fc9124a806a0418e686710989d4b086d2d44d0 SHA-256: e63b5e178b1aa54562cee42f18487bb93dcbff6d8d6a2857389c903585e0ca53
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file exhibits suspicious characteristics, including embedded child PDFs and remote GoTo actions, indicating an attempt to redirect the user to malicious content. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the presence of embedded files and remote actions strongly suggests a downloader or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
sombrero_uranus_656.pdf
a35ddc5753eae2e11f7dd5e09d9d8061e3e3fc856d6b8b84718b586f29aa01b3		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 224819 bytes
sombrero_uranus_656_1.pdf
42662af593d2b8dd89b2f295fffc9f81e7acc2e2b821b70777381be0141d9cef		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 311269 bytes
sombrero_uranus_656_2.pdf
d9e4950cd6bdbe12e3284f523e714f0cd4d2b5d1eeed403a6a13f13089dbe424		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F4 397752 bytes
stream_019_off0001a023.bin
e2a7f9af200670cba619482d3461b5023fd544007121433e9173a7519609f261		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A023 484298 bytes
objstm_0121_00.bin
8b96914ff8b8d1317fe9541c4746546779173f416674989fa7f9c9cbb10c03c5		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1123 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.