Malicious PDF — malware analysis report

Static analysis result for SHA-256 f771537578f6ea50…

MALICIOUS

PDF

590.7 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: f59c77ceae2ec00a6d8f639d27850970 SHA-1: 2bd8a5934315ec6826f23021572a8278fd49d412 SHA-256: f771537578f6ea50227b58883068d839aecf62dfb8ad92ba64ced949157965ae
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF exhibits critical heuristic findings related to embedded child objects and remote GoTo actions, indicating a malicious intent. ClamAV detection as 'Pdf.Dropper.Agent-7325281-0' further supports its malicious nature. The presence of multiple embedded PDF files suggests a multi-stage attack or a dropper mechanism. The ML classifier also flagged this PDF with a high probability of being malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7325281-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7325281-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
sombrero_venus_673.pdf
59c702628a1d6bcb1a4b748725fe2aee89470a3a8c0d76d4e13391ac16f3b11f		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F1 262473 bytes
sombrero_venus_673_1.pdf
3b7a1a27574aa6afc302f2259b30331b4ca92bfeff7344539cad6461b10e6e59		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F1 348946 bytes
sombrero_venus_673_2.pdf
70e75ca0102def2ea0d9c2618b83b9515596ef62224712d1df7e603135ca10b9		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9F1 435471 bytes
stream_019_off0001a022.bin
14737a130c08837f3c18ee19674611563e3f3cf696d27025370ef487f91d542e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A022 522039 bytes
objstm_0121_00.bin
67829c7cf3c483cc2242d1e762f4f65f34f5bf2f5b4371e3351ae35cf59d567e		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1120 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.