Malicious PDF — malware analysis report

Static analysis result for SHA-256 42d9ec6e6637781b…

MALICIOUS

PDF

422.8 KB Created: 2009-03-13 16:50:38 +08:00 Authoring application: Acrobat Web Capture 8.0
MD5: faa8766cb3a3f60f2e48d2cb1c7bec20 SHA-1: d0136bbb308b126205a336e4bbe53112423b4718 SHA-256: 42d9ec6e6637781b8c6f1b1ef532172ef838c0ed97915f61868190332249362e
210 Risk Score

Malware Insights

This PDF exploits CVE-2009-0658, a heap-spray vulnerability in Adobe Reader's JBIG2Decode filter. The exploit is delivered via JavaScript embedded within the PDF. The ML classifier strongly indicates maliciousness. The primary attack vector is the exploitation of a known vulnerability to achieve arbitrary code execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 9

  • Adobe Reader JBIG2Decode heap-spray exploit critical CVE likely CVE_2009_0658
    PDF combines JBIG2Decode image streams with a Reader 9 JavaScript heap-spray stage. This is the in-the-wild Adobe Reader/Acrobat JBIG2Decode exploit shape associated with CVE-2009-0658.
  • JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT
    JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JBIG2Decode filter medium PDF_JBIG2
    JBIG2 image decoder present — historically used in zero-click exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0027_000.js
266e00ca3d7ec0109b0318dd8d869c90daf6a2ec1208ffd2c74bb2ce91900b1d		 pdf-javascript-stream PDF /JS object 27 at offset 0x6BCC 1808 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
stream_001_off00002374.bin
6a71966cad617bfb05c2fc57e09517130f7abf80fb7d2cd8d6f9a72dd0ff8cc6		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2374 8958 bytes
jbig2_00_off000055da.bin
f95761e0340cb5897cdc57b2712e4ac8fa35eb43a6e2f9dd17a56be256b848ae		 pdf-jbig2-stream PDF JBIG2 stream at offset 0x55DA 4945 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.73, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.