Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ee38604f7538107…

MALICIOUS

PDF

107.0 KB Created: 2009-07-08 10:53:46 +08:00 Authoring application: Acrobat Distiller 7.0 (Windows)
MD5: 19a04566810ead0f8410feb7b3ab51ff SHA-1: e86b3f2af033b7f091c71bc33f5ae70fc30d2d2c SHA-256: 2ee38604f75381079768349bc7f7dadb5a682525f95e40ecb785fbd53edd1fad
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

This PDF file contains embedded JavaScript, identified by the PDF_JAVASCRIPT and PDF_JS heuristics. The critical CVE_2009_4324 heuristic indicates that the JavaScript is designed to exploit a known vulnerability in PDF readers, specifically related to media player functionality. The JavaScript likely concatenates information fields and evaluates the result to achieve its malicious objective, which is presumed to be downloading and executing a second-stage payload. No specific malware family could be identified.

Heuristics 4

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdfx/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0017_000.js
e09c11a234f64adaffab57715b8092ca8ba50bababda482d288dbb68b8e2db9b		 pdf-javascript-stream PDF /JS object 17 at offset 0x4DA 3452 bytes
js_property_alias_stage_000.js
dd112bcd2655c65dd6910fb28dff51e4621c079e5f6f80d579991898267abe5c		 deobfuscated-js JavaScript hex-escape property alias normalized stage at offset 0x4DA 3236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.