PDF malware analysis — malicious · 19aa55ed15bd4b37

MALICIOUS

PDF

533.5 KB Created: 2006-11-07 11:38:03 -07:00 Authoring application: Adobe Illustrator 11.0 (via Deep Exploration 5 5.0.4.1779 Release)

MD5: fd8369fc85e5b6ea8396222234e72100 SHA-1: e859fd0a8021d2b714b62aa2f657eb84fb9d753a SHA-256: 19aa55ed15bd4b3794cba5dbbfd826d01a2b8d61b163162b15eaf5b288711659

266 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The sample is a PDF file that contains multiple embedded JavaScript streams. Heuristics indicate the use of eval() and unescape() functions, common in obfuscated JavaScript exploits. The presence of 'PDF_U3D_CVE_RELATED' suggests exploitation of a vulnerability within the PDF's 3D content parsing, leading to the execution of the embedded JavaScript. This script is likely responsible for downloading and executing a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9735

Heuristics 11

U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ocsp.verisign.com0
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/g/img/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/
- https://www.verisign.com/repository/RPA0
- https://www.verisign.com/repository/CPS��
- https://www.verisign.com
- https://www.verisign.com/repository/verisignlogo.gif0�
- https://www.verisign.com/CPS
- https://www.verisign.com/repository/CPS
- http://www.adobe.com/typehttp://www.adobe.com/type/legal.html
- http://crl.verisign.com/tss-ca.crl0
- http://crl.verisign.com/ThawteTimestampingCA.crl0
- https://www.verisign.com/rpa
- https://www.verisign.com/rpa01
- http://crl.verisign.com/pca3.crl0
- http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
- https://www.verisign.com/rpa0
- http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0

Extracted artifacts 30

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0316_000.js` `1e2950c0f2d0eba5244e5985c7492536190eb8f3a09c8ea14abac06bfa4840fa`	pdf-javascript-stream	PDF /JS object 316 at offset 0x3D259	197148 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_030_off000169ec.js` `43e3fdc6cbd95878c1177a94fd6a6bdbef43149d53e54abf05fb4dcd63631e23`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x169EC	21857 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
`stream_031_off00017a81.js` `dc6ce8229cb592ba37e2d068966f5efe8cc1e7c51477dccdd722244100abbd0e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x17A81	17563 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
`stream_032_off00018836.js` `f249c2df1fb6980212557cc841f56cc48ceb687e281fcfeca142d84614cb8314`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x18836	10284 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 8 eval/decoder/string-building token(s).
`stream_036_off0001aaa7.js` `83f4b06c232b739564a1b488ef1c32da109c3bdbf388b0c8e34cc20cb7201cee`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1AAA7	2576 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_037_off0001ae9b.js` `8db95a9dbe8fe03d80e85dfc9c2b5a7e90b09c87809896cb1b8ea7710815f971`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1AE9B	7190 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_038_off0001b633.js` `8e6561ad4aa1e438bde21d3ee831718586c06c7d0cdb6aea941a590e2d5a5649`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1B633	10568 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
`stream_042_off0001d633.js` `5def854c629bf48ef47f2d2dfe6869bef72d20b823a54045015a2cfbadd646c1`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1D633	2736 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_043_off0001da4a.js` `461ad91933f66830e77baa705033ceb75d4b77b73383b8559a556431683efc15`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1DA4A	7314 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_044_off0001e1e8.js` `d05e5d4526854a9dee79b951af7fb22597f1d4c896a7e7b05c665d4be4d38ed8`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1E1E8	10265 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 8 eval/decoder/string-building token(s).
`stream_046_off0001f737.js` `d9a80a860e53eb01fae91884b5b6e03961c314043a7d59e56f95157383b3b34e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1F737	2724 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_047_off0001fb48.js` `e7b023cf1cc7aeb922de115df71c94a2aa51f5f8997cbca4f9fe2d891960980c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1FB48	7026 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_048_off000202cb.js` `4ec6405155376b89de18876abb353d0678664fdd4607d2edbf0cee23b2b2a39d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x202CB	10480 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s).
`stream_050_off0002150c.js` `c3a784c78e0f3ea801e56696acd5a07b3f40d35baa93da70f01d91a8818c9646`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2150C	2712 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_051_off00021922.js` `17d3e84653ea28124c04208acda42a1028a6a0366e36775a74eb55472d241681`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x21922	7253 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_052_off000220c1.js` `520296ab92fbef37a2f9ee44441fec382b561b95087eb1b86cbe9c53afaf9664`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x220C1	10601 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
`stream_054_off0002328f.js` `2587bb57c4e8af5ee221d999e6c371f1f1ff20c8a0bcbc49ac09dda621cc8e9f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2328F	2654 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_055_off0002369d.js` `8faf24d533ffe6dc9a0885deb5bfcd3185eff06f2896f984d33e42fcae54cf90`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2369D	7430 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 6 eval/decoder/string-building token(s).
`stream_056_off00023e56.js` `bb480adaac87307074a3459d33debd92624ce6d6927a9d4068f85ba69a878b77`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x23E56	10485 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s).
`stream_058_off0002515c.js` `68df787efafdbb3a3760ec7632622fc00ee92bc2f820b54e1be65343c6e0afd0`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2515C	2828 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_059_off00025581.js` `feef4c8e18cf72592c82d91b1acea57fda3b003ade14a46971750f344a3cbbc9`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x25581	7139 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_060_off00025d08.js` `0fffd3a027b251546946a67a377b3b65caf7120cf0c831a50c56ce59e7fcdcd6`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x25D08	10563 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
`stream_062_off00026f02.js` `a26e31809abcbc621ca33e43b631cf07d91c8dc771badc95ede735480fdb9e37`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x26F02	2906 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 6 eval/decoder/string-building token(s).
`stream_063_off0002732e.js` `e9990f5ce3d9ff6443cd9bb17946f4256ef2dd49a1726cfe96e5cd9d17d4ae00`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2732E	7142 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_072_off000580b9.js` `59602a991a423ddff7e5dcc97b7c586bd16290cdb805771563afae2ec3f7b181`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x580B9	150977 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`objstm_0327_00.bin` `620149db66898892b913b25f8f8db207667a98b862a26af9bd50ea70f0ea87f0`	pdf-objstm-decoded	PDF /ObjStm 327 0 obj (inflated)	406 bytes
`objstm_0328_00.bin` `535598c762851d4f3eb272c50f540d7018509b8be5e59cbc5f428396ec4efdcb`	pdf-objstm-decoded	PDF /ObjStm 328 0 obj (inflated)	4076 bytes
`font_00_sfnt_off00000a57.bin` `f39f99e2d4b021d4eac703afe26d32ad26f128c442f2089910c21b1f323fc85d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA57	79301 bytes
`font_01_sfnt_off0002b4a9.bin` `38c87f1cb90e40f6e683243d854d9c5893c132e6febb2612b28c2f689ab80b5e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2B4A9	97322 bytes
`u3d_00_off00048236.bin` `7cc946574ddbb2d8f08bf196bb1a9a65e39054ee04199ff958fd29c8a646a0e1`	pdf-3d-stream	PDF U3D 3D stream at offset 0x48236	139264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.