Malicious PDF — malware analysis report

Heuristics 8

• PRC/3D content in PDF high CVE related PDF_PRC_3D
  PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• Unusually high stream count medium PDF_MANY_STREAMS
  PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://192.168.10.7 In PDF document text

  • https://192.168.12.7In PDF document text
  • https://192.168.14.7In PDF document text
  • http://www.backtrack-linux.org/wiki/index.php/Main_PageIn PDF document text
  • http://icq.walla.co.ilIn PDF document text
  • http://www.icqmail.comIn PDF document text
  • http://www.yelem.org.ilIn PDF document text
  • http://media-2.cacetech.com/video/wireshark/introduction-to-wireshark/In PDF document text
  • http://www.spag-co.comIn PDF document text
  • http://www.searchengineshowdown.com/features/In PDF document text
  • http://whois.scIn PDF document text
  • http://www.dnspython.org/examples.htmlIn PDF document text
  • http://www.securityfriday.com/Topics/winxp2.htmlIn PDF document text
  • http://www.securityfriday.com/Topics/restrictanonymous.htmlIn PDF document text
  • http://www.paterva.com/web5/In PDF document text
  • http://www.backtrack-linux.org/wiki/index.php/UnicornscanIn PDF document text
  • http://www.oxid.it/downloads/apr-intro.swfIn PDF document text
  • http://www.oxid.it/In PDF document text
  • http://www.securesphere.net/download/papers/dnsspoof.htmIn PDF document text
  • http://www.ericphelps.com/scripting/samples/BinaryDownload/In PDF document text
  • http://127.0.0.1:55555/In PDF document text
  • http://127.0.0.1:55555In PDF document text
  • http://0.0.0.0:80/0dayIn PDF document text
  • http://208.68.234.98:80/0dayIn PDF document text
  • http://research.eeye.com/html/alerts/zeroday/index.htmlIn PDF document text
  • http://osvdb.org/browse/time_to_patchIn PDF document text
  • http://www.stunnel.org/In PDF document text
  • http://www.digininja.org/projects/cewl.phpIn PDF document text
  • http://project-rainbowcrack.com/In PDF document text
  • http://cracker.offensive-In PDF document text
  • http://www.nobodix.org/seb/win2003_adminpass.htmlIn PDF document text
  • http://linuxgazette.net/107/tomar.htmlIn PDF document text
  • http://192.168.10.14/bogus.phpIn PDF document text
  • http://127.0.0.1/In PDF document text
  • http://192.168.8.173/reportIn PDF document text
  • http://192.168.48.133/bogus.php?output=In PDF document text
  • http://www.phplibrairies.com/divers/SQLInjectionWhitePaper.pdfIn PDF document text
  • http://www.testbank.com/base-login.aspIn PDF document text
  • http://www.testbank.com/restricted.htmIn PDF document text
  • http://www.offensive-In PDF document text
  • http://www.heysoft.de/en/information/ntfs-ads.phpIn PDF document text
  • http://forums.offensive-security.com/forumsdisplay.php?f=69In PDF document text
  • http://forums.offensive-security.com/forumsdisplay.php?f=84In PDF document text
  • http://en.wikipedia.org/wiki/Penetration_testIn PDF document text
  • http://www.offensive-security.com/blog/backtrack/In PDF document text
  • http://www.offsec.com/pwbonline/icq.htmlIn PDF document text
  • http://company.icq.com/info/advertise.htmlIn PDF document text
  • http://chat.icq.comIn PDF document text
  • http://company.icq.comIn PDF document text
  • http://download.icq.comIn PDF document text

  +79 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.