PDF malware analysis — malicious · 2ba5cac0f6a56973

MALICIOUS

PDF

1.8 KB

MD5: d590578489dc89d696700853d9574a93 SHA-1: 1a88956ead7b20129bc8160a979f26a7395698b3 SHA-256: 2ba5cac0f6a56973cce75e519ea5e69367495b1291f25afc3f29138d9fc0852c

164 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The PDF file contains embedded JavaScript and utilizes ASCIIHexDecode and ASCII85Decode filters, indicating obfuscation. The critical heuristic firing for CVE-2008-2992 (util.printf) strongly suggests exploitation of this vulnerability for arbitrary code execution. No document body text was available for analysis, but the presence of exploit indicators and the specific CVE points to a malicious PDF designed to compromise the user's system.

Heuristics 6

util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
ClamAV: Pdf.Exploit.Agent-36183 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36183
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85

ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `f86b1e5220183f7c7e3ea8cddca0c8beed42f4aca8952f8c95b07b9823f2ed6e`	pdf-javascript-stream	PDF /JS object 6 at offset 0x138	1345 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.