PDF malware analysis — malicious · ec1e5bd5f9130e96

MALICIOUS

PDF

14.0 KB Created: 2011-10-19 23:00:49 +02:00 Authoring application: Writer (via OpenOffice.org 3.2)

MD5: e709dcca54b1acf51a07aa47c213b246 SHA-1: 4776019abcd78091258d26a6995cb7898522800a SHA-256: ec1e5bd5f9130e9644bc9ff3c10fd09417671a655c0a946722af53e06cb32a1b

78 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains heuristics indicating it is malicious and uses a phone number as a lure, consistent with callback phishing or tech-support scams. The embedded document body, though truncated, shows a bill-like format and includes a phone number, reinforcing the social engineering aspect. No scripts were extracted from this sample, limiting further analysis of its execution behavior.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0016.bin` `9030a0395160808bb19448f8dbfb1a15155e0c12fbdd3cc66af5beb224ca66ec`	pdf-embedded-file	PDF EmbeddedFile object 16 at offset 0x7E5	23581 bytes
`embedded_file_obj0014.bin` `d81baa73e490e4cb879e13927cacd1dd1be37524a37eac51603e15117c578777`	pdf-embedded-file	PDF EmbeddedFile object 14 at offset 0x30A8	84 bytes
`embedded_file_obj0015.bin` `24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0`	pdf-embedded-file	PDF EmbeddedFile object 15 at offset 0x315A	228 bytes
`embedded_file_obj0017.bin` `c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460`	pdf-embedded-file	PDF EmbeddedFile object 17 at offset 0x324B	199 bytes
`embedded_file_obj0018.bin` `846dfecc0c93797cb6db4301f6af323fffd76ffdf8c053c439495412785138e7`	pdf-embedded-file	PDF EmbeddedFile object 18 at offset 0x333C	119 bytes
`embedded_file_obj0019.bin` `e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876`	pdf-embedded-file	PDF EmbeddedFile object 19 at offset 0x33F4	77 bytes
`embedded_file_obj0020.bin` `92a3ce61d783e15932b5de127ce45a9b4c2f98f4da2453f65241573c1dda808a`	pdf-embedded-file	PDF EmbeddedFile object 20 at offset 0x349B	56 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.