Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e004c8c4d049ef2…

MALICIOUS

PDF

925.5 KB Created: BFO&;á0²LÇp]M9¹?ÝËJ8˜ÆGmÜw°.ېp’`›’¸^ÐóNÝ©» Authoring application: Rêî®t»ÍÕ¨]àÞÿ?Æ×Ñó¬yÜzYJCD°·ñp™¢szÔ\-|ݮϭHcv (via /å=ùìO]ÄM"@?§ï‰™¹jv2ˆ.ø`­\]5øùg ~gÞl¨¡^pfP) First seen: 2013-03-23
MD5: 0970c72035340e550e7c979011e8413b SHA-1: a3257e6abb8dd5e0f0b69e86cb779dcbf9665a6f SHA-256: 3e004c8c4d049ef2836a096b25949885cdd98159daddf1a9f9571c4f25fb43ee
226 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was flagged as malicious by ClamAV and a machine learning classifier. It contains embedded JavaScript, which is used to obscure malicious content and bypass static analysis. The presence of JavaScript actions and an encrypted PDF with JavaScript references strongly suggests it functions as a dropper, likely downloading and executing a second-stage payload. The ClamAV detection name 'Pdf.Dropper.Agent-6290497-0' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 9

  • ClamAV: Pdf.Dropper.Agent-6290497-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-6290497-0
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0011.bin pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x1367 163 bytes
SHA-256: 3b9fd8e0df28e0f39c3251b4ea4498173d1ed6879f58234f99f3575e12221e43
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x145A 1743 bytes
SHA-256: dbed39ba744b707df788443d2aca528b943e513a9a0b6a0e2e05b9f5c133f16d
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x17B2 10883 bytes
SHA-256: f87f3250d0138680bc1825a48b4d3721895ac84e52fb2f7349a929cb1df40220
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x28DD 3023 bytes
SHA-256: f6828dd1c2c33f5f9b3d297876597a713abd12a8e3a8bcc14eda8a62895139c5
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x2C6F 1147 bytes
SHA-256: 0525d57d759b3e8e2f4f08ca503b7552ca4ed15f1c03b84b152a525cfde03f5e
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x2EB6 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2F4E 147 bytes
SHA-256: ecbf3b394de0baf7299370049e2bb524eba2408f736364851f667f4f150c9081
javascript_obj0039_000.js pdf-javascript-stream PDF /JS object 39 at offset 0xE1F96 2844 bytes
SHA-256: bb2fe1c0b366bd3a48235c04e822305ef3ab04e575e155f93e34004f56cc10ec
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ R e a d e r _ D e s c   =   " A d o b e   R e a d e r   7 . 0 . 5 " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 c	  xn[�  ��S�W(~�N �}O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��Y
R6N�N  QW@�  W i n d o w s�  C T R L + C�  M a c�  C o m m a n d + C�	� q6T |��4R0`�v�mO��VhN-N僷S֋�~�O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 5 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  bS_ mO��Vh� ��c���SS�g e�rHg,v� Q�u0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 _ 7 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  N �}^v[���g e�v�rHg,0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ;
javascript_obj0040_001.js pdf-javascript-stream PDF /JS object 40 at offset 0xE22E2 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0041_002.js pdf-javascript-stream PDF /JS object 41 at offset 0xE243A 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_016_off000e3252.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE3252 1518 bytes
SHA-256: 5075dba5fa4e54badc25307cec2dcef587db8384bb87c4021d91de0eaf670a27
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 176 bytes
SHA-256: 61d4919f3e06694e07648cbdf5f075c26508a72b49a37b5d2c8fe10b22a433c0
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x164; filter decode failed 784 bytes
SHA-256: 6d7a0c1858cb53f755f87220c4e8fe61a3ecb8f50308210b107e75aaefdc166b
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x4D1; filter decode failed 4560 bytes
SHA-256: a75c651b1ef3a5c34e649823faf8224ac727ff59a3972daa75cd7690bc0785bf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0x16FD; filter decode failed 848 bytes
SHA-256: 671bf6ded21a507e180d2682cd14ff6b655c0148e95b44ad3152a3a2354bff34
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0x1AA9; filter decode failed 512 bytes
SHA-256: 954a44a9a5130d8c6455bdbd9ab1945e481f8c160a447c9e9204743363e4e139
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x1D04; filter decode failed 80 bytes
SHA-256: 861308393286a0bcf941ca0649c52b1a5285ec22ba044840a1a5f371db14041a
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x1DB0; filter decode failed 144 bytes
SHA-256: 83acd0a990fc2c400d98e2fc6787bf446e615734c7a6c0af44afe7d18862a613
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x1E9B; filter decode failed 48 bytes
SHA-256: 4d2572de817c610110c83dbc9d48393ab65fc4fed2d5dca3a79fe741b13cfb1d

Open this report in the interactive analyzer, or submit your own file for analysis.