PDF malware analysis — malicious · 0ee46eb133d0e49c

MALICIOUS

PDF

313.4 KB Created: 2010-09-24 17:00:51 Authoring application: Advanced PDF Repair at http://www.datanumen.com/apdfr/

MD5: 2757d9a22d40acb140c16fd5633d13b8 SHA-1: cae0201647fc5d0540894708168710f87f8fa72e SHA-256: 0ee46eb133d0e49ccac8948e1d6a7e57661ad4185bc7407d3012e7f00d4e6288

278 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript and exploits CVE-2010-2883, a known vulnerability in Adobe Reader. The embedded JavaScript, particularly the 'generic_stage_recovery' files, is designed to download and execute a second-stage payload. The ClamAV detection 'Js.Exploit.Shellcode-18' further confirms the malicious nature of the extracted JavaScript.

Machine Learning

Nyx PDF Classifier malicious score 0.9961

Heuristics 9

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.datanumen.com/apdfr/
- http://www.datanumen.com/apdfr/(
- http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.1/

Extracted artifacts 14

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0040_000.js` `2f574ea0a0abb643798c6edf545b9a2510056a799ef48c2f415cee8e337043b2`	pdf-javascript-stream	PDF /JS object 40 at offset 0x4EFA	9909 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0038_001.js` `48733a4072bca8bc8e070c48bde2ace252c1b0dcdfee3fc47a58c06457dbf5cb`	pdf-javascript-stream	PDF /JS object 38 at offset 0x289F	9624 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`javascript_obj0045_002.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 45 at offset 0xCA36	1242 bytes
`javascript_obj0046_003.js` `d8bbcc5984e6bec8996e18881fad0486ff520c9b9f03ee0fb9694ddfc412340d`	pdf-javascript-stream	PDF /JS object 46 at offset 0xCC5A	1572 bytes
`javascript_obj0038_004.js` `afccf0fbc111520e77d8969935c8ea9baa26bcbdb787967ce1d4ace8981a139e`	pdf-javascript-stream	PDF /JS object 38 at offset 0x28C1	310483 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 long base64-like blob(s).
`stream_000_off00000938.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x938	434 bytes
`generic_stage_recovery_000.js` `e91c6da7cc64f39f46c20d133684039a2e713295f6fdc8d49c2f80836b2eddc7`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	262144 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`generic_stage_recovery_001.js` `70411cc4cd96fb41eac0505bf4471f1df9478b5a571169c6feb28e95af66c39d`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	262144 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`generic_stage_recovery_002.js` `149a971646837ac16ea0c4c4f3525b9a738bab8d8d0eef0b1a7c1e9b33b36ac6`	deobfuscated-js	generic stage recovery marker-AAAAAAAA-to-%u -> marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	229649 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_003.js` `4bc2652d6b1b11ddeeede7bc1b54c64b5ca9bade3eb3ed93bebe77808d55f12b`	deobfuscated-js	generic stage recovery marker-AAAAAAAA-to-%u -> marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	225206 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_004.js` `fee81b58b01dff52a68dab612961eb6f23dac3cc620ba8d2558cd49fbdfe70f1`	deobfuscated-js	generic stage recovery marker-MM-to-%u -> split-literal-normalize from combined JavaScript objects at offset 0x4EFA	262141 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`generic_stage_recovery_005.js` `d0be8810e6b805ec2ab6ddd4c73d3cd71509401ca78477664eb16c3ca54b3f89`	deobfuscated-js	generic stage recovery marker-MM-to-%u -> split-literal-normalize from combined JavaScript objects at offset 0x4EFA	262141 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`generic_stage_recovery_006.js` `a6a55c6f8a336336766ea4662324d6c17879db9434b859f2a5a1b2abb9787dd0`	deobfuscated-js	generic stage recovery marker-AAAAAAAA-to-%u -> split-literal-normalize -> marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	229646 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_007.js` `4b91cbc79ec1300d4cc87e8048ff410541b37540c747a1c390aa55d631fb7214`	deobfuscated-js	generic stage recovery marker-AAAAAAAA-to-%u -> split-literal-normalize -> marker-MM-to-%u from combined JavaScript objects at offset 0x4EFA	225203 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.