PDF malware analysis — malicious · e91b4e31b83043a3

MALICIOUS

PDF

107.5 KB Created: 2018-06-12 09:41:10 -04:00

MD5: a844f5f96600422be5b20c369fbfab87 SHA-1: f70570733daf71255a23ace7f23e086e4815a28a SHA-256: e91b4e31b83043a3d6f546bd5abfba4fb838e7ae73bb1326b97d0f0a48b9fa6d

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains JavaScript that automatically executes upon opening, displaying a fake Adobe Acrobat Updater prompt. This prompt is designed to deceive the user into allowing a remote connection, and the associated JavaScript action attempts to submit form data to a suspicious URL. The embedded JavaScript is the primary mechanism for executing the malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9477

Heuristics 8

PDF auto-runs JavaScript form submission on open critical PDF_OPENACTION_JS_SUBMITFORM

PDF uses /OpenAction to run JavaScript that calls submitForm() with an external HTTP(S) URL. Opening the document triggers the outbound submission path without requiring a normal link click.
PDF JavaScript shows fake Acrobat updater prompt high PDF_FAKE_ACROBAT_UPDATE_LURE

PDF JavaScript displays Acrobat/update-themed language such as a document rendering engine update or remote connection to Adobe servers. When paired with JavaScript or external submission, this is a social-engineering lure rather than benign document text.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://socialmedia.insights.bloemlight.com/XUzFKME1HNW9VRzlNVGtkM2FVdzFjQzlETDJ3eFVqRmpWREZsT0cxR2JpdHRRMU14Y1hCemFVSnRaRVJpTkVGclJYVmxaMkpGTlN0UlpFWk9NbnBzY1ZOVlpWTXlWMEowY1RKTk1IRlJiSGQ2TDJGaVYzTmxaekJvTlhGQmNsbHRjRnByVFhkVGFVeGhaa2s5TFMxa1ZrbHNibmRTWjFoVmJVdENUaXREVVhaak5rRlJQVDA9LS1kODNlYzUzMTI3YjIyOTVjZmYxZWRkOGEzMWM5MjgyNDA1NWYxMDRh?cid=76449576#FDF
- https://socialmedia.insights.bloemlight.com/XVjFwNlNVdEhiRXA1WkROS2FXcDRWakpPTlRodU56UnFaV1I1ZVdsR1REVlJUVXQxSzJSV1JGbDFUbnBRYUZKbVExRk1NVEpFWldGWmVsUnJZazVIWldWdlRFMHdOVFpUYlV0a2RrdEhUemd5Vm1Zd2RGaGpPVFk0U3pkcFltVnZWWHBYV2xFelYwNWtiMEV5UnpjcmNuSnhOVFZDTmxOUFJVWmpVSHBXVVZwMlpXeDRka2x0WkVzNFZsWnNTMEZJZW1oRFFUUmFZMWczUjBWRGJHdGxjbEZHUzNKMFUzbGpORUZqVkcxcWRUZGlLMWd6UVhNMGQwdDNXVXhSUm1WeExTMVVNMlF2UzJSQ1ZYaEdkRGtyV25SdVNHZFFZV0puUFQwPS0tYjU3OWQ3OWQ3ZDdjNDUxMjZiNjBiZTM3Zjg2YzgyNGI4YTllMjQ5Yw==?cid=76449576
- https://socialmedia.insights.bloemlight.com/XV1d0MWQzbDJWM05xU0ZKYWFuSjJhVUl6VVc5M1ZVZDZXbU5OUW1OdWIyUlRSMms1Y1VJeE1EWnBTSFZrYUd4eGVEbFFUSFpVUzNaelptWmxkbGhFYVVwVFRIUldTVTFsTUZSVWNEa3lXVzU2ZVZaVGRIaFJXa1pSTWtsTWRVVXZkekphVkZWc1lrRlBWQ3RHZERnd05tOU5OakZ6WW5GblEzUlRjblJxY1d0U1IydzBha1pCYmtNdldtZzRjMGt4VW5WU09UVkxPVXQyYnpKTFdqUXpTMWx2TkRKS05YbENNRXhQWW1wRU9YRkhVWFpRVDFSTVJqQmlSVGxyTVRkbUxTMUhXbk5vZVZGaVdFcHNUMWhVTDBZMVJrc3ZTM05SUFQwPS0tZmZiYmE1N2Q4MzAzNDE5YjE3YTY5ZDQyYjM3YzVmZTIyNGQ2ZjZhYw==?cid=76449576
- https://socialmedia.insights.bloemlight.com/XTmxCcWJEZ3pWVmhTZDJSc2JrRnBSbEZGTlhKT2RWb3JXbmN6VTNGNFZVOVJWalZWVGxwSU4yOUJWMlpRV1hCTFYyVnVSVXBUT1hWbVlTdE1hamhOVVdSdVlXcFJWWGRvUVcxR1ZUTlpkVkpNUTBSU2MwaEtaMkkxT1ZadVVrODJiMW9yZURkTWNpOHpibWRKU0ZKM1UzZHRRV1JvYm5GbFVscEhPRE5sUzJVdmEyWkNMell6YzNoSVdrTmFZbkExZGpsWll5dEZUamR1ZEZWMFJVZFhkWHA2ZWtJd1pHdFRLMjh2UW1OSVVUQlFaa0ZZTkdaSFVqbFpha3R2TlRVd0xTMWxhMmsyVjJncmQyWXpTMlZZV2xkWlEzUm5OVmhCUFQwPS0tMTNjZDhiZWYxNWE0MjRlMGI3YTEwNjdjMjFiMWI1OGNiNWVhYzIxYg==?cid=76449576
- https://socialmedia.insights.bloemlight.com/XVjFwNlNVdEhiRXA1WkROS2FXcDRWakpPTlRodU56UnFaV1I1ZVdsR1REVlJUVXQxSzJSV1JGbDFUbnBRYUZKbVExRk1NVEpFWldGWmVsUnJZazVIWldWdlRFMHdOVFpUYlV0a2RrdEhUemd5Vm1Zd2RGaGpPVFk0U3pkcFltVnZWWHBYV2xFelYwNWtiMEV5UnpjcmNuSnhOVFZDTmxOUFJVWmpVSHBXVVZwMlpXeDRka2x0WkVzNFZsWnNTMEZJZW1oRFFUUmFZMWczUjBWRGJHdGxjbEZHUzNKMFUzbGpORUZqVkcxcWRUZGlLMWd6UVhNMGQwdDNXVXhSUm1WeExTMVVNMlF2UzJSQ1ZYaEdkRGtyV25SdVNHZFFZV0puUFQwPS0tYjU3OWQ3OWQ3ZDdjNDUxMjZiNjBiZTM3Zjg2YzgyNGI4YTllMjQ5Yw==?cid=76
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/tiff/1.0/
- http://ns.adobe.com/exif/1.0/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `d495f7d5b22895f10ea48672f8a1a34e9c2a996be2c40ae9122d67f7e6d993e4`	pdf-javascript-stream	PDF /JS object 12 at offset 0x180A	612 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0012_001.js` `0167920706ac97784c44d450a423564738b04ca8075977439aa941f385bd0598`	pdf-javascript-stream	PDF /JS object 12 at offset 0x1831	103890 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 8 long base64-like blob(s).
`font_00_cff_off000196f7.bin` `9340d372ad75a105fdb1627a30e96f892e0dc7d9588c0150cf06b4fa72281cc0`	pdf-font-stream	PDF embedded font (cff) at offset 0x196F7	4575 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.