Malicious PDF — malware analysis report

Static analysis result for SHA-256 42069ec763664244…

MALICIOUS

PDF

2.5 KB
MD5: b77e56fb59513814f22aae8e919ae785 SHA-1: 48ba5473d7533f136d675cb77c467487a3fd817e SHA-256: 42069ec7636642445622b2f5f417bbb82dce600e030c7d5a182ced39826cd17d
76 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The critical heuristic firing indicates that this PDF file exploits CVE-2010-0188, a vulnerability in Adobe Reader related to LibTIFF and XFA forms. This exploit is designed to execute arbitrary code, likely to download and run a second-stage payload. The presence of an embedded file further supports the delivery mechanism.

Heuristics 3

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
9d2a7aed7abc8d4fe27eca9370ad9117cb361be033f1446b28448019863b8ce2		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x51 13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.