Malicious PDF — malware analysis report

Static analysis result for SHA-256 24dc183daa7b9e29…

MALICIOUS

PDF

114.6 KB
MD5: a677ef0e2cf94e4095a066482fd5a621 SHA-1: 242b653ebf5a2f02e57c7e820e0d804f478eeff7 SHA-256: 24dc183daa7b9e29dbb208cefac488726c49ac4aef539cb844d398b4e918d36c
138 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.001 PowerShell

The PDF file contains a critical heuristic indicating exploitation of CVE-2010-0188, a known vulnerability in Adobe Reader related to LibTIFF XFA image parsing. This suggests the document is designed to execute code upon opening. Additionally, a secondary embedded PDF was found with similar suspicious findings, reinforcing the exploit-based delivery. The exact payload or subsequent actions are not detailed in the provided evidence, but the primary intent is code execution via the identified vulnerability.

Heuristics 5

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
4039e9c998334ff031d82f5ca110045c516b3c5ea8785535b9ad33d41166a47b		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x4F 13560 bytes
polyglot_child_pdf_off00019b64.pdf
1bf8fe9cae8502ee18c09616fa438f565457adf6c6318c1785100a8540f1825a		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x19B64 12066 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.