PDF malware analysis — malicious · 42a6f4d5aa44f030

MALICIOUS

PDF

440.2 KB

MD5: 68a483033a6b1ff9d3eb001e92859600 SHA-1: 145e4b5051b7a59ab351896d36a176e6c71b3707 SHA-256: 42a6f4d5aa44f0307aa37e67e53300bbf684ac82fb533cb10a5e99ccbfdc7a2a

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript and triggers a critical heuristic for CVE-2010-2883, an Adobe Reader CoolType SING font exploit. This indicates the file is designed to exploit this vulnerability to gain execution. The embedded JavaScript streams are likely responsible for downloading and executing a secondary payload, although their exact function is obscured by obfuscation. The presence of multiple JavaScript streams and the exploit firing strongly suggest a malicious intent.

Heuristics 6

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0029_000.js` `5c9d0914ec18dd2f560830912df2a19056f19c175c1a74b63074374de6c639de`	pdf-javascript-stream	PDF /JS object 29 at offset 0x6BF01	15252 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`javascript_obj0038_001.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 38 at offset 0x1C6AE	1242 bytes
`javascript_obj0039_002.js` `d8bbcc5984e6bec8996e18881fad0486ff520c9b9f03ee0fb9694ddfc412340d`	pdf-javascript-stream	PDF /JS object 39 at offset 0x1CC82	1572 bytes
`stream_004_off00000cd0.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xCD0	434 bytes
`font_00_sfnt_off00001313.bin` `6ddf1ad4724af53fb11f98a18777952d438571fc7e7c49b6604c501c45de5865`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1313	65935 bytes
`font_01_sfnt_off00013660.bin` `f47c9abb5d2db9eba0120d21ad1d12a5aa7a16ae2c86c7f440007027a87eb56a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13660	65935 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.