Malicious PDF — malware analysis report

Static analysis result for SHA-256 1036375cc71760ec…

MALICIOUS

PDF

202.5 KB Created: 2007-12-27 12:52:04 -08:00 Authoring application: Adobe LiveCycle Designer ES 8.2
MD5: 2aaf8f0765c3992a594dde54d10bc49b SHA-1: 07b20cd09f91e8a4026ee83a846f47895ac22ae7 SHA-256: 1036375cc71760ec51366726592c24917529847bbb9cdc19ec7e004c44c71ce8
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains JavaScript that utilizes the unescape() function and is associated with an XFA form, indicating an exploit attempt. The SubmitForm action suggests the JavaScript is designed to download and execute a second-stage payload from a remote location, likely initiated via spearphishing. The URL http://cgi.adobe.com/special/acrobat/update was found embedded within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5654

Heuristics 11

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • SubmitForm action medium PDF_SUBMITFORM
    PDF has a /SubmitForm action — form data can be silently posted to an attacker-controlled URL (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Embedded script payload in PDF stream low PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xci/2.8/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://www.xfa.org/schema/xfa-locale-set/2.7/
    • http://www.xfa.org/schema/xfa-locale-set/2.1/
    • http://ns.adobe.com/xtd/
    • http://ns.adobe.com/xfdf/
    • http://www.xfa.org/schema/xfa-form/2.8/
    • http://cgi.adobe.com/special/acrobat/update

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0088.bin
c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb		 pdf-embedded-file PDF EmbeddedFile object 88 at offset 0x22426 85 bytes
embedded_file_obj0089.bin
7a441cbf3872425cb4c7705b2f967e622253a43f16fa95d4d07675112695743d		 pdf-embedded-file PDF EmbeddedFile object 89 at offset 0x224D9 1518 bytes
embedded_file_obj0090.bin
1b19b49a0a1b1f8a84e5822247a507b8d3e529f576f2c226f5ed2a8a3f577d43		 pdf-embedded-file PDF EmbeddedFile object 90 at offset 0x227B5 62580 bytes
embedded_file_obj0091.bin
bedd959c13bda4171d6fec94e714894b4eb8f330d4332ddec77cee286cb02363		 pdf-embedded-file PDF EmbeddedFile object 91 at offset 0x24671 4373 bytes
embedded_file_obj0092.bin
226eeacc5eecef2a05ca480f144ff6936594e20b5c7672e8f29f25c8bea65a56		 pdf-embedded-file PDF EmbeddedFile object 92 at offset 0x24B9A 2928 bytes
embedded_file_obj0093.bin
4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5		 pdf-embedded-file PDF EmbeddedFile object 93 at offset 0x24F08 200 bytes
embedded_file_obj0094.bin
aa33350d7d6e065ba712c99cce2ee688e22d8d6fdd9fcc4634ccd065c80cd69f		 pdf-embedded-file PDF EmbeddedFile object 94 at offset 0x24FFC 1223 bytes
embedded_file_obj0095.bin
2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19		 pdf-embedded-file PDF EmbeddedFile object 95 at offset 0x25251 80 bytes
embedded_file_obj0096.bin
88b3b648350d60d77f474fca72470a37937d62085749223ca2a4b882fc6eed4a		 pdf-embedded-file PDF EmbeddedFile object 96 at offset 0x252FC 382 bytes
embedded_file_obj0544.bin
12849cb5b637a67bc92337b2cea0c11116eee65bc2e4d96bc7dea88dbfaca583		 pdf-embedded-file PDF EmbeddedFile object 544 at offset 0x3194F 411 bytes
stream_002_off00002e1b.js
dd6e063204762394fe1e5984b5562281379b07e2b5cfa3242c04077d0cc7807c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E1B 11505 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
stream_003_off0000377e.js
f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x377E 1532 bytes
stream_004_off0000396a.js
4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x396A 870 bytes
stream_105_off00026c19.js
4a3be1c97fa660c78458adbf8467d9ef0ece4b4be6574ddb6a76861e566be29f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x26C19 999 bytes
objstm_0311_00.bin
ae3f7e8da0037725a5acbb781fdd0f8290baa651f5929c299703995441bd3f0d		 pdf-objstm-decoded PDF /ObjStm 311 0 obj (inflated) 22721 bytes
objstm_0102_00.bin
7bfff91f1cbcb99094706a67de0efab93065be7f4821bf03d6a4768a6044b191		 pdf-objstm-decoded PDF /ObjStm 102 0 obj (inflated) 171 bytes
objstm_0547_00.bin
8555523eea72d95d4e0e32296f6b2a6d1f06ff2a33c76c3e512b54c5dac0b268		 pdf-objstm-decoded PDF /ObjStm 547 0 obj (inflated) 4548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.