Kinda confused, isn't this PDF file actually malware?

[Studynxx]

VirusTotal

VirusTotal

www.virustotal.com

It's a Microsoft-Intune-related PDF training file. Apparently it IS an actual PDF file but why the hell does it drop an PE EXE? Also, look at the behavior

Don't you think it looks like it's malicious?

 

[Bot]

Yes, it does seem suspicious. A legitimate PDF shouldn't drop an executable file. The behavior you've linked to also indicates potentially malicious activity. It's recommended to avoid opening it and to report the file.

 

[cartaphilus]

VirusTotal

VirusTotal

www.virustotal.com

It's a Microsoft-Intune-related PDF training file. Apparently it IS an actual PDF file but why the hell does it drop an PE EXE? Also, look at the behavior

Don't you think it looks like it's malicious?

Depends. All the ms cookbook PDFs I've found legally were paid for books at avg price of $19.

If this is a paid for book that's hosted as a free book then most likely you are the $$$ so yeah it might be malware

 

[Studynxx]

Depends. All the ms cookbook PDFs I've found legally were paid for books at avg price of $19.

If this is a paid for book that's hosted as a free book then most likely you are the $$$ so yeah it might be malware

Yeah it is, I'm just training for a job. But what I mean is, look at the behavior, it's strange as hell. What are all those dropped files, coming from a PDF file?

I've actually launched it on an isolated VM with process explorer running and thus far VT (in Process Explorer) hasn't flagged anything. Plus I got Kaspersky and it says it's clean as well.

I'm quite wary

 

[cartaphilus]

Yeah it is, I'm just training for a job. But what I mean is, look at the behavior, it's strange as hell. What are all those dropped files, coming from a PDF file?

I've actually launched it on an isolated VM with process explorer running and thus far VT (in Process Explorer) hasn't flagged anything. Plus I got Kaspersky and it says it's clean as well.

I'm quite wary

After firing it off in a VM can you not save it as doc Nd then save it again as PDF or leave it as doc? Open the PDF in MS office. Or try to convert it to lower version PDF to maybe squash some of the script abilities that might require higher version functions.

I am just spit balling here since sharing of copyrighted file is not permitted.

Edit: so you are saying it's a free PDF? If so did you download it from a reputable site like your local library or a book rental place? If so then maybe it's part of their time based copyright system???? Do any other pdfs from that location also drop executables? And is it the same executable?

 

[struppigel]

This request violates the rules of this forum section. Locked.
Note the point of unwelcome requests: "requesting sample analysis without any context or effort on the requesters part"