Malicious PDF — malware analysis report

Static analysis result for SHA-256 3abb9132993e5b3c…

MALICIOUS

PDF

13.1 KB Created: 2011-11-02 19:21:39 +04:00 Authoring application: Adobe Acrobat 10.0 (via Acrobat Web Capture 10.0)
MD5: 2f283b09e94f0d3b23a3ea6da8645828 SHA-1: 3432df6c1f4abddb514931fc6b79f3711e36c741 SHA-256: 3abb9132993e5b3c88cf8bd347913434cb191ffbd2da556b49e79e454c39e2b6
288 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link

This PDF file contains embedded JavaScript that exploits multiple Adobe Reader vulnerabilities, specifically CVE-2007-5659 (Collab.collectEmailInfo) and CVE-2008-2992 (util.printf). The JavaScript is obfuscated using a character-table decoding method, a common technique for delivering exploits. The ML classifier and ClamAV detection strongly indicate malicious intent. The primary function of the script appears to be the execution of further malicious code, likely a downloader for a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • ClamAV: Pdf.Exploit.Agent-36776 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36776
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0024_000.js
479f4716c7449a0974fa3dfe2f68d41d078eb29b8cf2b22d537688f96166b46e		 pdf-javascript-stream PDF /JS object 24 at offset 0x2617 11342 bytes
array_char_table_stage_000.js
a8c8ee72833d729322b84db6b967a7903d433f7d6e141b214269ed9171e59b79		 deobfuscated-js array character-table decoded JavaScript at offset 0x26A4 3849 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
icc_00_off000018a6.icc
653b586c4707574ffcd648ba35494daed2c76ceafcf4c07d315ed961b1dc347f		 pdf-icc-profile PDF ICC profile at offset 0x18A6 408 bytes
icc_01_off00001a00.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x1A00 3144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.