Malicious PDF — malware analysis report

Static analysis result for SHA-256 1db935894a68814c…

MALICIOUS

PDF

64.3 KB
MD5: 8dd28860aceefb4bde4e9fbe1a3557df SHA-1: a5c6a79d3f064042575c7416aef7a3d51cc4e0a1 SHA-256: 1db935894a68814c6af27ef2acf04b94e6a2979141b67a3e8bcf88f5a3d2442a
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains embedded JavaScript that leverages the CVE-2009-4324 vulnerability, specifically targeting the media.newPlayer function. This indicates an attempt to execute arbitrary code upon opening the document. The presence of unescape() calls and obfuscated JavaScript streams further supports this malicious intent. No specific malware family could be confidently identified.

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0052_000.js
45fea71ee6347153ec3719ebc3910509cd6fa568f263c29e7474c694308f5c7d		 pdf-javascript-stream PDF /JS object 52 at offset 0x3F4E 301 bytes
javascript_obj0057_001.js
86821d7edcc8142fc94d3635e99ccf3c8781bfa43bd3ee98de9716f6ee24a490		 pdf-javascript-stream PDF /JS object 57 at offset 0x5500 2523 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
stream_005_off00000b74.bin
e4217c167299ac63f64b8b7e903cc0196f0828693d273431b8b793a12ed0fed3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB74 1000 bytes
objstm_0053_00.bin
f9797d0fa28384c30d8bf1da89163104ce539753e417fa1f9c5fd135d1eceb39		 pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 50 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.