Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4b664e6fd8c7ead…

MALICIOUS

PDF

553.2 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 06d7550cf8e482e1c1bcf55a8236caa9 SHA-1: 5179aa3a4a36b4163308456ad017f392a5e970f2 SHA-256: f4b664e6fd8c7ead0b32c8394d5ff1020403d1c5d44de5581c639f7db4b60f63
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious PDF T1566.002 Phishing: Spearphishing Attachment T1071.001 Web Protocols: HTTP

The PDF file exhibits multiple suspicious characteristics, including embedded files and remote GoTo actions, as indicated by the PDF_EMBEDDED_CHILD_STATIC_TRIAGE and PDF_GOTO_REMOTE heuristics. The ML classifier also flagged it as malicious with a high score. While no specific script was extracted, the presence of embedded files and remote actions strongly suggests an intent to deliver a secondary payload or redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 4

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cigar_earth_118.pdf
eb6393b2b3d8382bb5354c9d16e2b285dc67640e42545e83165f30e10f1b01be		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 224028 bytes
cigar_earth_118_1.pdf
a629b08474f892c37a239208291313f643a6dc66822a3d23e9e28c50436bdc6c		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 310531 bytes
cigar_earth_118_2.pdf
f052f9fe209049ffab135c3d29274cc97c539a57b9fb4e58076bf3bedad8e597		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9E8 396980 bytes
stream_019_off0001a01d.bin
af753ea4475dda27122e4de1a3a4e23654370133661c770dbf043565a76df26a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A01D 483512 bytes
objstm_0121_00.bin
05b456163d1dd8087745b6a5dd001aa88bdf4445d40e08c67e57663b89ab9017		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1111 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.