Malicious PDF — malware analysis report

Static analysis result for SHA-256 267dd682e2ba44bb…

MALICIOUS

PDF

245.9 KB Created: 2009-06-16 09:44:09 +08:00 Authoring application: Adobe Acrobat 9.0 (via Adobe Acrobat 9.0 Image Conversion Plug-in)
MD5: 9589db7401a318e8b229fd85bf0ddba3 SHA-1: aa76ce40f73edfddfe11f4ca8b90092e233b7e40 SHA-256: 267dd682e2ba44bbe8578838e13f6053f4a768d2a27df5e044b87f9211c3354d
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

This PDF file contains embedded JavaScript that utilizes a heap-spray technique to exploit CVE-2009-0658 in Adobe Reader. The embedded JavaScript stream, identified as 'javascript_obj0021_000.js', is the primary indicator of malicious activity. The exploit likely serves as a dropper for further malicious code, although the specific payload is not detailed in the static analysis.

Heuristics 11

  • Adobe Reader JBIG2Decode heap-spray exploit critical CVE likely CVE_2009_0658
    PDF combines JBIG2Decode image streams with a Reader 9 JavaScript heap-spray stage. This is the in-the-wild Adobe Reader/Acrobat JBIG2Decode exploit shape associated with CVE-2009-0658.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0021_000.js
77a06e269c5d498ea7016a170b1e2157cad1d1bc5a2ada366925dbde210a2c68		 pdf-javascript-stream PDF /JS object 21 at offset 0x4917 1809 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
jbig2_00_off0000040a.bin
3e443902fb271a9e3708a72bc56311512411e2624c8f30d62987c370131d2a38		 pdf-jbig2-stream PDF JBIG2 stream at offset 0x40A 572 bytes
jbig2_01_off000028fe.bin
e93e979412b94a506ae31c152956c4889ab60b93b4714810c9bf797091e458bc		 pdf-jbig2-stream PDF JBIG2 stream at offset 0x28FE 3056 bytes
jbig2_03_off0003b4a8.bin
89d5b80842410173320430ea959bdf3cea46790b18746f5803ec0e3ad2e88f8e		 pdf-jbig2-stream PDF JBIG2 stream at offset 0x3B4A8 3056 bytes
polyglot_child_pdf_off00038baa.pdf
ab59c43a57c58577ba517ceabcf8e1337d96f7b919364a3cd41c34d28028b3af		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x38BAA 19431 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.