Malicious PDF — malware analysis report

Static analysis result for SHA-256 f893d8c9d196b09a…

MALICIOUS

PDF

590.9 KB Created: 2010-03-31 12:55:11 -04:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: b5c15fd4678406ab19439b71dc3b8f9b SHA-1: 8d1d2f19cd8719dceb5144ef20c44827739677ef SHA-256: f893d8c9d196b09a6e293786b6deae1d52b6055395bbc4aaefdcadd37633daa3
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by ClamAV as Pdf.Dropper.Agent-7336730-0 and a machine learning classifier indicated a high probability of maliciousness. The presence of embedded files and remote GoTo actions suggests it's designed to download or redirect to malicious content. The ML_NYX_PDF_MALICIOUS heuristic and the critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE firing strongly indicate a dropper or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8662

Heuristics 5

  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • ClamAV: Pdf.Dropper.Agent-7336730-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7336730-0
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#
    • http://ns.adobe.com/xmp/InDesign/private
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/g/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
andromeda_sun_717.pdf
113f7a44ca3a62c93f4d44d24ef8ee054dd81528f9e6dfa0ad7f8b7193264f8a		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 262688 bytes
andromeda_sun_717_1.pdf
1f71832faa8c7de1b98c33ad2f5535a604fc94521b323aa9c8d10f19feeffbdf		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 349152 bytes
andromeda_sun_717_2.pdf
e58081afe964ac3fa9b138d132a81374443b320c38850f88f7bba5e48a9f04a0		 pdf-embedded-file PDF EmbeddedFile object 244 at offset 0x1A9EE 435660 bytes
stream_019_off0001a020.bin
c5f833df77377698a9d4837fb16e6351f2f9337bf3baa3c0f0fc93b595c97c7d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A020 522229 bytes
objstm_0121_00.bin
42f3b042189e67ffdf4123c773462cc95bcf43185a740e179398baa7f6869984		 pdf-objstm-decoded PDF /ObjStm 121 0 obj (inflated) 1117 bytes
font_00_cff_off0000b46d.bin
38d7d0627d6ef08fdb595be75f8f12752f3381fa7a1441ca8f76a5e76dc6e7b9		 pdf-font-stream PDF embedded font (cff) at offset 0xB46D 609 bytes
font_01_cff_off0000ba3f.bin
5f3f348279f5218a0f3607c4a8e7c1b2190742072e04b58112191aa6b4235f52		 pdf-font-stream PDF embedded font (cff) at offset 0xBA3F 886 bytes
font_02_cff_off0000c1e7.bin
7e5cb310f6cb7822b8a316192e8347738bb3f1d76fe954bdbf17623d2e87f2fb		 pdf-font-stream PDF embedded font (cff) at offset 0xC1E7 3808 bytes
font_03_cff_off0000d457.bin
99bc093cddfa13f76f619bedeaf723ce24882a341f9686e35da3cad8dbab0a72		 pdf-font-stream PDF embedded font (cff) at offset 0xD457 3669 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.