Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6c0ba91c8b5ea9e…

MALICIOUS

PDF

590.8 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 8c26d9154da5d45035472fe2005a0b1c SHA-1: c777c01dfabbbc1a952b368f060f6d6a51f0bedf SHA-256: f6c0ba91c8b5ea9efcf697a371a45b7d0bd04df03d91c14b285928b837bfbe8d
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious PDF T1566.002 Phishing: Spearphishing Attachment T1071.001 Web Protocols: HTTP

The PDF was flagged by multiple heuristics as malicious, including ClamAV detection of 'Pdf.Dropper.Agent-7324942-0' and ML classification. It contains embedded PDF files and uses remote GoTo actions, indicating it's designed to redirect the user or download additional malicious content. The presence of embedded PDFs suggests a dropper or downloader functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7324942-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7324942-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
cartwheel_mercury_318.pdf
b39ad4adb63be7e50fe77533f1189491543af4ec2cf4baa18698a55dccdc18c3		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FA 262553 bytes
cartwheel_mercury_318_1.pdf
565204844eda4589c58ef6d9ce8f6fb7a98fe905884a2cd15f394f96a4c1b3e2		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FA 349028 bytes
cartwheel_mercury_318_2.pdf
0ac6fa3a18b62423b693b47e04d1212718671921aa75236e3f66786f39db3ec2		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9FA 435558 bytes
stream_019_off0001a024.bin
954e5d8fd56b53ae29aab420dc696c76695490f64a8ade38a8727a1525337a69		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A024 522130 bytes
objstm_0121_00.bin
4acd219c56faed2e9c2681e76ded32de379f24cb6a412ec85bc32bd38c821791		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1129 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.