Malicious PDF — malware analysis report

Static analysis result for SHA-256 03f5445a5cc4f9d6…

MALICIOUS

PDF

1.37 MB Created: 2009-12-08 17:32:40 +01:00 Authoring application: Adobe LiveCycle Forms 8.2
MD5: 18d0b496edb13c733e8a845d962f80dc SHA-1: 1cd3a251985ecf0c3fc8d5f1ff4c30fad008412a SHA-256: 03f5445a5cc4f9d6b8f53b02022ff4c5951c9a94a9cc0d7c720ea848d42bc136
294 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains multiple JavaScript streams and XFA form elements, which are flagged as containing exploit code and heap-spray techniques. The embedded JavaScript attempts to prompt the user to download an update, likely a lure to download a malicious payload from the URL http://cgi.adobe.com/special/acrobat/update. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9853

Heuristics 12

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION
    PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY
    PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.aef-europe.be&lt;/website&gt
    • http://www.hrdc.bg&lt;/website&gt
    • http://www.llp.org.cy/&lt;/website&gt
    • http://www.kmk-pad.org&lt;/website&gt
    • http://www.oapee.es&lt;/website&gt
    • http://phonebook.cimo.fi&lt;/helpdesk&gt
    • http://penelope.2e2f.fr&lt;/helpdesk&gt
    • http://www.2e2f.fr&lt;/website&gt
    • http://www.apa.lv&lt;/website&gt
    • http://na.org.mk/comenius/&lt;/website&gt
    • http://www.eupa.org.mt/&lt;/website&gt
    • http://comenius.org.pl/eforms&lt;/helpdesk&gt
    • http://comenius.org.pl&lt;/website&gt
    • http://www.programkontoret.se&lt;/website&gt
    • http://www.cmepius.si/&lt;/website&gt
    • http://www.programmallp.it/comenius&lt;/website&gt
    • http://www.anefore.lu&lt;/website&gt
    • http://pv.org.pl/eforms&lt;/helpdesk&gt
    • http://pv.org.pl&lt;/website&gt
    • http://www.naep.cz/index.php?a=view-project-folder&amp;amp;project_folder_id=63&amp;amp;&lt;/website&gt
    • http://www.na-bibb.de&lt;/website&gt
    • http://na.org.mk/grundtvig/&lt;/website&gt
    • http://grundtvig.org.pl/eforms&lt;/helpdesk&gt
    • http://grundtvig.org.pl&lt;/website&gt
    • http://www.programmallp.it/grundtvig&lt;/website&gt
    • http://www.naep.cz/index.php?a=view-project-folder&amp;amp;project_folder_id=34&lt;/website&gt
    • http://eu.daad.de&lt;/website&gt
    • http://na.org.mk/erasmus/&lt;/website&gt
    • http://erasmus.org.pl/eforms&lt;/helpdesk&gt
    • http://erasmus.org.pl&lt;/website&gt
    • http://www.programmallp.it/erasmus&lt;/website&gt
    • http://www.programmaleonardo.net/llp/&lt;/website&gt
    • http://na.org.mk/leonardo/&lt;/website&gt
    • http://leonardo.org.pl/eforms&lt;/helpdesk&gt
    • http://leonardo.org.pl&lt;/website&gt
    • http://pajhome.org.uk/crypt/md5
    • http://www.adobe.com/products/acrobat/readstep2.html
    • http://www.adobe.com/support/products/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xfa/promoted-desc/
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xci/2.7/
    • http://www.xfa.org/schema/xfa-template/2.7/
    • http://www.w3.org/1999/xhtml
    • http://www.xfa.org/schema/xfa-data/1.0/
    +17 more URL(s)

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0059.bin
5f74bccebf610588508b48d69409280d955a5aa9cd7bc850681ffd267a9ab91f		 pdf-embedded-file PDF EmbeddedFile object 59 at offset 0x157DA0 162 bytes
embedded_file_obj0060.bin
733d7316afc56956773d0daeef327a47e6ef63eb4c71a44c54a3c1f583145a19		 pdf-embedded-file PDF EmbeddedFile object 60 at offset 0x157E93 147794 bytes
embedded_file_obj0061.bin
5246abb6453591b41c0ab2b5dfaa0b0d2cb0ac8c6c3abd1f5977622144fa27c1		 pdf-embedded-file PDF EmbeddedFile object 61 at offset 0x15A300 101188 bytes
javascript_obj0021_000.js
f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf		 pdf-javascript-stream PDF /JS object 21 at offset 0x1819 1313 bytes
javascript_obj0022_001.js
1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd		 pdf-javascript-stream PDF /JS object 22 at offset 0x19F6 902 bytes
javascript_obj0023_002.js
826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f		 pdf-javascript-stream PDF /JS object 23 at offset 0x1B4F 2795 bytes
embedded_pdf_script_000039ba.bin
01ca5448ce9bcc79d5b11bc14678c2a044a07fe4377ce9cfd3c39199e34f6130		 pdf-embedded-script PDF raw stream script payload at offset 0x39BA 7653 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.