PDF malware analysis — malicious · 368e678cf9fb3a59

MALICIOUS

PDF

497.0 KB

MD5: 9303ce16508dead5ab88c9e55fc80710 SHA-1: 08daf50c331d926397d154c4977393b939cbc415 SHA-256: 368e678cf9fb3a590a72317633c65228eb3e53d24769615c53f52a02a620bb1c

178 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 JavaScript/JScript

The PDF file contains embedded JavaScript and exploits a known vulnerability (CVE-2007-5659) related to the Collab.collectEmailInfo function. Heuristics indicate the presence of JavaScript actions and embedded JS streams, along with U3D content which can also be used for exploitation. ClamAV detection as Pdf.Dropper.Agent-6309414-0 further confirms its malicious nature. The primary attack vector appears to be leveraging the JavaScript to download and execute a secondary payload.

Heuristics 6

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
ClamAV: Pdf.Dropper.Agent-6309414-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-6309414-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0229_000.js` `1847af0a099665b6ac45af66402e56ed64237a1b287618ee3d6643267fda6f35`	pdf-javascript-stream	PDF /JS object 229 at offset 0x7B078	343 bytes
`legacy_pdfkit_stage_000.js` `775c1620ac5bc923d43acc9f0d0e4afcb725a689cf6034f662f1852c29df003a`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x6EA3	12928 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`legacy_pdfkit_stage_001.js` `33b39a8806a25dad689fff30c5caa714c3d8028633487970a1b0f2ef4c949c3a`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x6EA3	5337 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`font_00_sfnt_off0000bb5a.bin` `80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBB5A	52108 bytes
`font_01_sfnt_off00014242.bin` `336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14242	48764 bytes
`font_02_sfnt_off0001daa9.bin` `2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1DAA9	23432 bytes
`u3d_00_off00000326.bin` `48816569ab4f370009a917ef6429edbe09e4dfe8a63b00a0a0f75a904c62ba94`	pdf-3d-stream	PDF U3D 3D stream at offset 0x326	27449 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.