Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e11e0c3dba0f39b…

MALICIOUS

PDF

201.3 KB Created: 2009-03-11 15:56:53 +08:00 Authoring application: PDFCreator Version 0.9.3 (via AFPL Ghostscript 8.54)
MD5: 12ca3cb6091cf503b474c1496e1041e4 SHA-1: 89fdc524c7c69725f2642ef4826a0d1624e16038 SHA-256: 0e11e0c3dba0f39b388a4858e63c7105d9d8187857fc65ab0420660015de25ec
338 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits CVE-2009-0927 (Collab.getIcon). The JavaScript is obfuscated using `unescape()` and `String.fromCharCode()`, common techniques for hiding malicious code. The primary function of the script appears to be executing arbitrary code, as indicated by the exploit cluster firing and ClamAV detection. The script likely downloads and executes a second-stage payload, although the specific URL or payload is not directly observable in the provided evidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9696

Heuristics 10

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/iX/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js
31891b256fb2c725efed8b2bbf38a5e15a3a35b583d76d8b3fb5ee6c8b85f769		 pdf-javascript-stream PDF /JS object 1 at offset 0xF 55 bytes
javascript_obj0055_001.js
2fad1f5cb3aa3aabb644f595f2b2f678aa6f58d13bf2a6c493aeaa380ed91ab2		 pdf-javascript-stream PDF /JS object 55 at offset 0x3120E 6266 bytes
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
combined_document_js_000.js
76be403f41b249e1315213431daf5cdac970d67fb048af9fea7474008e52d987		 deobfuscated-js combined document JavaScript streams at offset 0xF 6322 bytes
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
font_00_sfnt_off00005ee1.bin
51f1bd9423cd723c587f4887ef911151884a1423f8e3bf9ae43ee102ccdfcea7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EE1 84540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.