PDF malware analysis — malicious · 106b9aa5d91ce9e8

MALICIOUS

PDF

6.5 KB First seen: 2026-05-10

MD5: 4fc617e2bbdf963c38fff6fad6d32536 SHA-1: 9553f2f6d16d4a464bca763f388976a21f0d65f1 SHA-256: 106b9aa5d91ce9e81d671537fae45cc1d78d636a3d2bc178f4a4f49b8ab98753

234 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample contains obfuscated JavaScript that leverages multiple CVEs (CVE-2009-0927 and CVE-2007-5659) via the Collab.collectEmailInfo and Collab.getIcon JavaScript objects. This indicates an attempt to exploit vulnerabilities in the PDF reader to gain execution. The primary goal is likely to download and execute a secondary payload, although the specific URL or mechanism is not directly extractable from the provided evidence.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after nested-decoder de-obfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after nested-decoder de-obfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
JavaScript action low 1 related finding PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Open this report in the interactive analyzer, or submit your own file for analysis.