Malicious PDF — malware analysis report

Static analysis result for SHA-256 1fa4ed18b515906b…

MALICIOUS

PDF

1.8 KB
MD5: 9bc2353113d5271eeeadb8db97266368 SHA-1: 7b073df93523542474c42652881237bc114eef8c SHA-256: 1fa4ed18b515906b3dcfa3e87307be9a8f86ffc1bc72a89a66edbb9f67d6a8bf
164 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1059.001 Command and Scripting Interpreter: JavaScript

The PDF file contains embedded JavaScript and utilizes ASCIIHexDecode and ASCII85Decode filters, indicating obfuscation. Critical heuristics identify the CVE-2008-2992 exploit (util.printf) and ClamAV detection as Pdf.Exploit.Agent-36183. This suggests the file is designed to exploit a vulnerability in PDF viewers to execute arbitrary code.

Heuristics 6

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Pdf.Exploit.Agent-36183 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36183
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
f86b1e5220183f7c7e3ea8cddca0c8beed42f4aca8952f8c95b07b9823f2ed6e		 pdf-javascript-stream PDF /JS object 6 at offset 0x138 1345 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.