Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a2a5e4146967901…

MALICIOUS

PDF

2.5 KB
MD5: 9a5e82e88ebb411006bc60cdfe6ff213 SHA-1: 5cad3ec318e5c5d6bb058640bb59dfcdc496644d SHA-256: 2a2a5e4146967901f3add731166bfd6a6f765ce7fb740d23b7430675510f5633
76 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The PDF file contains an embedded XFA form that triggers the CVE-2010-0188 vulnerability in Adobe Reader. This exploit is designed to execute arbitrary code, likely leading to the download and execution of a second-stage payload. The embedded artifact is a binary file, further indicating a malicious payload delivery mechanism.

Heuristics 3

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
075db645e97474a74200cccfde14856b0592bf0f497ca682916184c24151c720		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x51 13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.