Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d5ee31d8aad8807…

MALICIOUS

PDF

2.3 KB
MD5: 67b425c328e129397d81218169cb6b60 SHA-1: 04c74d608c7a152d1eb7056a5f6712ceb426dc31 SHA-256: 1d5ee31d8aad8807834b65f394ad866dd1c375ad1cf147b3b0992de0689f4d35
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1204.002 Malicious File

The PDF document contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. A critical finding is the CVE-2008-2992 exploit, identified by a util.printf call within the JavaScript. This exploit is known to target PDF readers to achieve arbitrary code execution. The presence of unescape() further suggests obfuscation of malicious JavaScript code. The primary intent appears to be the exploitation of this vulnerability to download and execute a secondary payload, though the specific payload and its destination are not directly discernible from the provided static analysis.

Heuristics 5

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj263984_000.js
0cadecb550362d3161da6347a983be1a19a7ca2cb973bb329e5a963ce400daef		 pdf-javascript-stream PDF /JS object 263984 at offset 0x197 7063 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
javascript_obj263985_001.js
e8822234618667b8a9b83972153b9fb3737130942a4bb21afc217efbc470a1a9		 pdf-javascript-stream PDF /JS object 263985 at offset 0x6D9 153 bytes
javascript_obj263986_002.js
92134a52923091e35f64d6c97e1f9834b3961f370292e6c59d5a67768908a165		 pdf-javascript-stream PDF /JS object 263986 at offset 0x7A9 516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.