PDF malware analysis — malicious · 3aa76cdb43f6420a

MALICIOUS

PDF

163.6 KB Created: 2006-06-18 12:11:19 Authoring application: Image to PDF Converter, Build: Jul 14 2008 (via Image to PDF Converter (http://www.imagepdf.com))

MD5: 60b28116da8bde1ece9c4f2c2add5d24 SHA-1: 8f3af013dc110d665e56729afd744a5878deb0af SHA-256: 3aa76cdb43f6420a7066ff817f32c8357022e7115e195ac6ba516733f5b5bdab

362 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains JavaScript that exploits CVE-2009-0658, a heap-spray vulnerability in Adobe Reader's JBIG2Decode filter. This exploit is designed to download and execute a second-stage payload, identified by ClamAV as Win.Trojan.Sofacy-1. The embedded executable payload and the exploit indicate a high likelihood of system compromise.

Heuristics 13

Adobe Reader JBIG2Decode heap-spray exploit critical CVE likely CVE_2009_0658

PDF combines JBIG2Decode image streams with a Reader 9 JavaScript heap-spray stage. This is the in-the-wild Adobe Reader/Acrobat JBIG2Decode exploit shape associated with CVE-2009-0658.
JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT

JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD

PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JBIG2Decode filter medium PDF_JBIG2

JBIG2 image decoder present — historically used in zero-click exploits
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.imagepdf.com/)/S/URI
- http://www.imagepdf.com
- http://www.imagepdf.com\))/ModDate(D:20090511165817+08
- http://www.imagepdf.com/
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/iX/1.0/

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0048_000.js` `783466de9230d343207160f4d99483011e5fb9c5d3b5d8bb3ab7d8f5b8d0e049`	pdf-javascript-stream	PDF /JS object 48 at offset 0x49C	491 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`embedded_pdf_00014104.exe` `5b984d54453d3a3bd47025fac3d3a9eb1c59df8a41c0b4631c887958c4203b7e`	embedded-pe	PDF decompressed stream PE payload at offset 0x14104	85356 bytes
Detection ClamAV: Win.Trojan.Sofacy-1 Obfuscation or payload: likely Carved artifact entropy is 7.82, consistent with packed or encrypted content.
`jbig2_00_off00000ec7.bin` `c876ffd1636552ad56c091fc71e427bfcbe8bf5be6b932363047745bffdd936f`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0xEC7	6887 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.71, consistent with packed or encrypted content.
`jbig2_01_off00002dbd.bin` `13135e18100476acf64d12883ae147d8ce65873b370a6defb93431dadcc105a5`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2DBD	13608 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`jbig2_02_off000066fc.bin` `dedfefe24558656a9350fd65eb2e76d46445da7fc98e71e8b9da1dea89224515`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x66FC	12266 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`jbig2_03_off00009b01.bin` `7df82efccc2213d446a2ca88f1000d8de6a1f92d7388b1fa1d9bcdb7b233ceaf`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x9B01	13472 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`jbig2_04_off0000d3bc.bin` `8b9eee256bf34e2892fae9fec405f9339cc7e088f3630c5e25f0af2e5aa9cf57`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0xD3BC	13894 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`jbig2_05_off00010e1c.bin` `141b31cb3bc5af7860119f0f1f911b088b18bc07d392e4d5b94040ebbe9bc961`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x10E1C	6796 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.95, consistent with packed or encrypted content.
`polyglot_child_pdf_off0001c882.pdf` `1df8b725b74668b7089a9a03a55dc86244326de81e939bddb34810e988e9c128`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x1C882	50684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.