Malicious PDF — malware analysis report

Static analysis result for SHA-256 2da89e9eabc612fe…

MALICIOUS

PDF

1.8 KB
MD5: e5f2b0ea993fbb5d87c0758a5ce33e8f SHA-1: 28ef1772465b005c6927161723e32d5c2acc52ae SHA-256: 2da89e9eabc612fe773a0f0979b17954c09e75acac61ae572f4e96414215533d
166 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059.001 PowerShell

The PDF file contains embedded JavaScript and utilizes filters like ASCIIHexDecode and ASCII85Decode, which are often used to obfuscate malicious content. The critical heuristic firing for CVE-2008-2992 indicates the exploitation of a specific PDF vulnerability. This suggests the file is designed to deliver a payload by exploiting this known flaw.

Heuristics 6

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Pdf.Exploit.Agent-36183 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36183
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
f86b1e5220183f7c7e3ea8cddca0c8beed42f4aca8952f8c95b07b9823f2ed6e		 pdf-javascript-stream PDF /JS object 6 at offset 0x138 1345 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.