PDF malware analysis — malicious · efb45ff147c69afd

MALICIOUS

PDF

796 B

MD5: cdd579205a75bb7f7fd42d11e6c8c8ac SHA-1: 92ecb2f84c4763680ab68fd000a6d7b1a2e42050 SHA-256: efb45ff147c69afd0ccbb028739aa82fc790aaf82e9e4320702c92e6bf68efdb

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1204.002 Malicious File

The PDF contains a launch action that executes cmd.exe. This command is designed to echo a VBScript payload into a file named 'm.vbs' and then likely execute it. The VBScript payload is obfuscated but appears to use 'Scripting.FileSystemObject' and 'WScript.Shell', indicating it is intended to download and execute further malicious content from the embedded URL http://mjef.info/k4/tmp/m.vbs. The confidence is high due to the clear indicators of a multi-stage attack involving a PDF launcher and a VBScript downloader.

Heuristics 4

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
/Launch action target: cmd high PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/c echo B="m.vbs":With CreateObject(StrReverse("PTTHLMX.2LMXSM"'.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://mjef.info/k4/tmp/m.vbs

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_pdf_script_0000006f.bin` `ad55c8e83a5896a04b2012c676820daeab2b84cc539e444c6366e79f55a571c5`	pdf-embedded-script	PDF decompressed stream script payload at offset 0x6F	63 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.