Malicious PDF — malware analysis report

Static analysis result for SHA-256 f563be7f138b397a…

MALICIOUS

PDF

56.7 KB Created: 2011-06-22 16:17:54 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 3.0.015 (http://www.tcpdf.org))
MD5: 208c3bc612b3c2617e19d29423cf85c8 SHA-1: 1f62fb49a86b6d7bcd74ac10f59060b89bfb104d SHA-256: f563be7f138b397adc4a53ef91836257e8b6c3cdac0b17d441a4a3fb350f383b
64 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1204.001 Malicious Link

The sample is a PDF file that contains an embedded URI pointing to an external resource. Static analysis identified a critical heuristic firing for CVE_2008_2551, indicating the use of a known exploit for C6 Messenger. This suggests the PDF is designed to exploit this vulnerability, likely to download and execute a second-stage payload from one of the embedded URLs. The majority of extracted URLs are confirmed benign, but the presence of the exploit heuristic is sufficient to classify this as malicious.

Heuristics 3

  • C6 Messenger DownloaderActiveX exploit critical CVE exact CVE_2008_2551
    PDF stream bytes contain HTML/ActiveX content configuring the vulnerable C6 Messenger DownloaderActiveX control with propDownloadUrl and propPostDownloadAction=run. This is the published exploit shape for CVE-2008-2551.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artisanballoonz.com/system/system.exe
    • http://www.irna.ir/View/FullStory/?NewsId=1225289
    • http://www.farsnews.com/newstext.php?nn=8904230102
    • http://www.presstv.ir/detail.fa.aspx?id=134657&sectionid=351021501
    • http://www.farsnews.com/newstext.php?nn=8904230001
    • http://www.farsnews.com/newstext.php?nn=8904230024
    • http://www.presstv.ir/detail.fa.aspx?id=134617&sectionid=351021504
    • http://www.presstv.ir/detail.fa.aspx?id=134625&sectionid=351021509
    • http://www.presstv.ir/detail.fa.aspx?id=134663&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134626&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134605&sectionid=351021506
    • http://www.presstv.ir/detail.fa.aspx?id=134667&sectionid=351021507
    • http://www.presstv.ir/detail.fa.aspx?id=134612&sectionid=351021503
    • http://www.presstv.ir/detail.fa.aspx?id=134582&sectionid=351021507
    • http://www.farsnews.com/newstext.php?nn=8904220149
    • http://c6.community.alice.it/download/DownloaderActiveX.cab#Version=1,0,0,1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000023f5.bin
80ce46be3b4d5733393d911e720cc341eac961413bc8841086c1643fee9fc14b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x23F5 73272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.