Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd30c8d83e9674b2…

MALICIOUS

PDF

276.2 KB
MD5: 32839aa6734ac6f048bc7d3abed96820 SHA-1: df9223c15654857637524bf9e5ed93dade4b7166 SHA-256: fd30c8d83e9674b21cc5e52ad3e41e4ffa281f038b5a7c270212fe3ff3902ab9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1204.002 Malicious File

The PDF file contains a launch action that executes cmd.exe. The command line parameters indicate an attempt to echo a string that likely contains obfuscated commands for downloading and executing a secondary payload. The document body is encrypted and unreadable, but the heuristic firings strongly suggest a malicious intent to execute arbitrary commands.

Heuristics 2

  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/C echo Set fso=CreateObject("Scripting.FileSystemObject"' — references a known-dangerous executable (cmd, PowerShell, etc.).