Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ace032b53a64769…

MALICIOUS

PDF

1.8 KB
MD5: bc3edffbb5b13cbe8bab70ca4e95b464 SHA-1: c0b526efbc9bbd37c33d21aac6882e8700e71c6e SHA-256: 0ace032b53a64769a390eec46879b2c28ae6fcc7291b7582227cdf26557f1545
134 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains embedded JavaScript that utilizes the util.printf function, indicating exploitation of CVE-2008-2992. The JavaScript is heavily obfuscated but appears to construct a URL for downloading a second-stage payload. The reconstructed URL is "http://www.occe.329.com/ofph?p=65bof-e302-9932-992". This exploit allows for client execution and the subsequent download of further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
83c8a5ec6859407c31b39b3125bcbb28518ebf6aab42b4fa693ae02f089c80b5		 pdf-javascript-stream PDF /JS object 6 at offset 0x138 1333 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.