Malicious PDF — malware analysis report

Static analysis result for SHA-256 31d4443bd802f694…

MALICIOUS

PDF

133.3 KB Created: 2000-01-01 Authoring application: Acrobat Distiller 4.0 for Macintosh First seen: 2015-09-27
MD5: 434e895befbf1b8252577e2c8e3a8770 SHA-1: d6a3b7ccea1a9fa72f41fb690aa3f64666db65d4 SHA-256: 31d4443bd802f694f958f98f9acfd2f10df6138e0579def11994c225b580eced
544 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

This PDF file contains embedded JavaScript and a PE payload, indicating malicious intent. The critical PDF_LAUNCH and PDF_LAUNCH_COMMAND heuristics, along with the CVE-2010_1240 detection, confirm that the file attempts to execute cmd.exe with specific parameters. This is further supported by ClamAV detections on both the PDF and the extracted artifact, suggesting it acts as a dropper for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 13

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\06086325.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doi.acm.org/10.1145/332051.332079 In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
06086325.pdf pdf-embedded-file PDF EmbeddedFile object 85 at offset 0x182F5 79111 bytes
SHA-256: 09f728520e1e534673d0ef7e707b54ee6c057d6d3ec87f6b0474d80d6aa68ffb
Detection
ClamAV: Win.Trojan.MSShellcode-6360730-0
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=06086325.pdf; kind=pdf-embedded-file
javascript_obj0086_000.js pdf-javascript-stream PDF /JS object 86 at offset 0x21092 57 bytes
SHA-256: 19e3fb33409050f42963b4d253d30193d427409f3fc570d48c58481d7e5be997
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "06086325", nLaunch: 0 });
stream_018_off00013024.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13024 11059 bytes
SHA-256: 2d7f1f29ed81490929b4cff075d9aaee86e95d16c1123ba2a37d27e0b893159f
font_00_cff_off00000fc8.bin pdf-font-stream PDF embedded font (cff) at offset 0xFC8 1546 bytes
SHA-256: 3ba103feaa935389e9aca5004b7e409adf3890c6f0d979c0f45ce15a72ecd5e9
font_01_cff_off000019a9.bin pdf-font-stream PDF embedded font (cff) at offset 0x19A9 1141 bytes
SHA-256: e383026abea5d6076a22fdff61bb21c3df08710d86913079e493937f98714956
font_02_cff_off00002e3e.bin pdf-font-stream PDF embedded font (cff) at offset 0x2E3E 4759 bytes
SHA-256: 6180a385fc3d52804cc8d990b690c6fedee8256227992750be7862bcc2d83a29
font_03_cff_off000043ac.bin pdf-font-stream PDF embedded font (cff) at offset 0x43AC 12303 bytes
SHA-256: 7ff142b5ac07f86345b3afd2a09e84e6e92270a7ec2b2dc1a3fcd43a7b60c301
font_04_cff_off000071a8.bin pdf-font-stream PDF embedded font (cff) at offset 0x71A8 8270 bytes
SHA-256: cc651472fd6fe2a236670c3084c23589f9294520e5aaa98b4654b900f1f273a1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.
font_05_cff_off0000940e.bin pdf-font-stream PDF embedded font (cff) at offset 0x940E 5684 bytes
SHA-256: d82eb45d01988b1c1a5e743696cdaf4ae1fc7cc47a7b3abc240e01493db8eb6e
font_06_cff_off0000ad2c.bin pdf-font-stream PDF embedded font (cff) at offset 0xAD2C 3666 bytes
SHA-256: 5be998d7f9990a8a292369fdd6a218bb1a42f8a34395579c3ecd413dcefb5dde
font_07_cff_off0000bf26.bin pdf-font-stream PDF embedded font (cff) at offset 0xBF26 2367 bytes
SHA-256: bef2db66189d82167ff20c19446cd1965b6e682eb11de527cf35d01344cdd796
font_08_cff_off00012d87.bin pdf-font-stream PDF embedded font (cff) at offset 0x12D87 299 bytes
SHA-256: 9ac8be8556bfc64f26722e2077c4131556614ac62d9f1c04a3322a7be81e7e2d
font_09_cff_off000146bd.bin pdf-font-stream PDF embedded font (cff) at offset 0x146BD 3084 bytes
SHA-256: 7274e992ddbbb85cb9eac08c003b61cf8ae49b18b67054823f58703b49640458
font_10_cff_off0001567c.bin pdf-font-stream PDF embedded font (cff) at offset 0x1567C 3615 bytes
SHA-256: a899af8eab89b8d8343f2b59c6b1e76b614d05a169c043012baa64c004bf5dd9

Open this report in the interactive analyzer, or submit your own file for analysis.