PDF malware analysis — malicious · 016f73924cd8cd21

MALICIOUS

PDF

24.1 KB

MD5: c8c7d53d7a2a95bfd97c9e97a93dcd4a SHA-1: 2702cfb84d848c8da8f5dad41e879189cf7f88c8 SHA-256: 016f73924cd8cd21c8203ed62cf150ce6fa3807cd8956e158a283c8715f44f4d

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious File T1566 Phishing T1566.002 Spearphishing Attachment T1190 Exploit Public-Facing Application

The file is a PDF that contains an XFA form, which is leveraged to exploit CVE-2010-0188 in Adobe Reader. This exploit is designed to download and execute a secondary payload. The embedded URL, while seemingly benign, is part of the exploit chain. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains the CVE-2010-0188 exploit template: XFA JavaScript heap-spray setup, a generated TIFF image payload, and assignment of that TIFF data to an XFA image field rawValue to trigger Adobe Reader's LibTIFF parser.
ClamAV: Pdf.Exploit.Agent-36821 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36821
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.xfa.org/schema/xfa-template/2.5/

Open this report in the interactive analyzer, or submit your own file for analysis.