Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b95c1cfc62a38a4…

MALICIOUS

PDF

639.0 KB Created: @¯;£U+Ê1ÃíCs8ð<ËÍç!a¬ˆDvì!•®}«=)X‚®fòïx»„ <‚& Authoring application: !¹W¢KaÝZ…Ñs2vÒ1sÖ]T"Uؑþÿ\œaÓ®µ>RÍÊé;¼”ÉR•Ó (via ów>àHšºDŒh§¦è²òvø½€Ü<C ƒèía¬S23£v‚üþ՝@Œ|ØÌä) First seen: 2012-09-20
MD5: 78f957584e5d264670c9d7ed6a3fe715 SHA-1: e5439325c4caeee1f01a72370a3b40e869e12f2e SHA-256: 1b95c1cfc62a38a4adf5107e26287501a0c5be032269948fd0e42de1d220bd42
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF contains embedded JavaScript and is encrypted, with heuristics indicating that the JavaScript is used to hide the payload. This suggests a multi-stage attack where the JavaScript is responsible for decrypting and executing malicious content. The presence of XFA forms and embedded files further supports a complex document structure designed for evasion. No specific family could be identified due to the obfuscation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 9

  • Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883
    PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x18D1 86 bytes
SHA-256: f7ee3ef2f8f35d669a6c2b8b0b0ee89655bbc3d04b107a8d22531830f6fc28a1
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x1985 1500 bytes
SHA-256: f5539c38e00fcac22036c8229b25a9759d88cee56903f2b486522fb9997e131b
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x1C5B 7249 bytes
SHA-256: bc58168ac4a2200c24dec7a9fa61cb5d115d2a4dd5f28f34359baf41a95b3581
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x26B3 159 bytes
SHA-256: da19a956510de42d8522c11b25445b3efa52056541ed94d34b6ccf27c6a9ff47
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x2786 3023 bytes
SHA-256: 7a3baf6cd7005199e771f5fac95d2162e961b145b52976bfa7d0f32a10c9758d
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2B17 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x2C0B 1223 bytes
SHA-256: 5db8459035200514d633eb95d00f91d8b382d009649e7a3e8c627b745c91f193
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x2E5D 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x2F07 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
eflow.jpg pdf-embedded-file PDF EmbeddedFile object 38 at offset 0x391C 24941 bytes
SHA-256: 9003a4da2ee82a593e4b01ba8b828bd7081f1269e54579fa40641d3d5357f75d
javascript_obj0040_000.js pdf-javascript-stream PDF /JS object 40 at offset 0x9B6CE 2844 bytes
SHA-256: bb2fe1c0b366bd3a48235c04e822305ef3ab04e575e155f93e34004f56cc10ec
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ R e a d e r _ D e s c   =   " A d o b e   R e a d e r   7 . 0 . 5 " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 c	  xn[�  ��S�W(~�N �}O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��Y
R6N�N  QW@�  W i n d o w s�  C T R L + C�  M a c�  C o m m a n d + C�	� q6T |��4R0`�v�mO��VhN-N僷S֋�~�O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 5 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  bS_ mO��Vh� ��c���SS�g e�rHg,v� Q�u0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 _ 7 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  N �}^v[���g e�v�rHg,0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ;
javascript_obj0041_001.js pdf-javascript-stream PDF /JS object 41 at offset 0x9BA1A 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0042_002.js pdf-javascript-stream PDF /JS object 42 at offset 0x9BB72 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_012_off000943a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x943A4 32400 bytes
SHA-256: 0601c4b533d97a420b6c976136126d6e4d79c0f357e07bcf80adaf2c57144440
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.74, consistent with packed or encrypted content.
font_00_sfnt_off0009c6f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C6F4 71524 bytes
SHA-256: 426fc31e492fe224eea571b50d4b8a8539f1b24595527e3932236df755edd36a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A)
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 112 bytes
SHA-256: d6dafb4a0f9c48a1fb7e8919b9457dc57b58505ffea6361621380d321e172291
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x124; filter decode failed 656 bytes
SHA-256: 51c6631d231d78402c6627dde1eebedd06af4d1474779be2854492e55b8a0604
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x411; filter decode failed 2656 bytes
SHA-256: 7081c67ed94d2cacf8c4c45f5c42ebf45d73c7bbbe8df29b41c1b3870b8b575d
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0xECD; filter decode failed 144 bytes
SHA-256: 8d37961ef98b5e5e957519c099012e5dc95de98564c27f495a8920937e8c1ebe
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0xFB9; filter decode failed 848 bytes
SHA-256: d285c33e33cab12eb442b5c56c65f9dd938a124c84e4f1649a76315d3760596f
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x1365; filter decode failed 176 bytes
SHA-256: 36e4aae12a2091b90b899064ae3b3211ebd37981bd3ba9b41a7ea4d9b47631d3
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x1471; filter decode failed 528 bytes
SHA-256: 98e8ac3081f94ac33c926a9df6f2d381f251947f2b261210043d498f046c7485
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x16DD; filter decode failed 112 bytes
SHA-256: d3a518902eeb3826df30b3e2716319ec3c74db8a326835c77b3f1bf788fec814

Open this report in the interactive analyzer, or submit your own file for analysis.