PDF malware analysis — malicious · 430731653f91f047

MALICIOUS

PDF

328.7 KB Created: 2006-11-07 11:38:03 -07:00 Authoring application: Adobe Illustrator 11.0 (via Deep Exploration 5 5.0.3.1555 Release)

MD5: 669023a5e2f2dcac6255915cc4dbc212 SHA-1: 04b6a7df3ee8aba973a0c7c16109f3905f07292e SHA-256: 430731653f91f047683b9770c83d85940fa1a1809c933d29471c9d2d20c6e07b

174 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams, with high-confidence heuristics indicating the use of eval() and unescape() for obfuscation. One heuristic specifically flags a U3D/3D content vulnerability (CVE-related). The embedded scripts are likely responsible for executing a malicious payload, possibly downloading further stages or exploiting a vulnerability. Due to the heavy obfuscation and lack of clear indicators within the script content itself, the exact payload and delivery mechanism remain uncertain, leading to an 'unknown family' classification.

Heuristics 10

U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/g/img/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0063_000.js` `bcef52c23bbfe13bc3409aec0e7b015d4868fc086094814e2790ac12dbbc8b07`	pdf-javascript-stream	PDF /JS object 63 at offset 0x1DE78	187572 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`stream_010_off0001bd48.js` `83f0e3117230a4942827ef354efb831d505f83a1546ceb7cbd336b12cb2a5942`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1BD48	22212 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_011_off0001cde4.js` `f8b13a3863af702dcd7e3941443dec10025d7a2a53f54e108dfaf2b8e3f2695f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1CDE4	17918 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`stream_014_off00028813.bin` `34b766ef104ed4b4a296d35242f093cb5bd6f2e25d49e99f6ac2bbce71594db9`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x28813	198944 bytes
`stream_015_off0003ba0d.js` `293e87bad017638b7a9abe516b617a4baabdee4dce16511a4d1238c1e0dd2409`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3BA0D	151320 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`objstm_0074_00.bin` `bc83b3de83c51e9b757fcc9746f522882b3a13b24ecd13ff8a8cafd59e94ae80`	pdf-objstm-decoded	PDF /ObjStm 74 0 obj (inflated)	520 bytes
`objstm_0075_00.bin` `d1412d6e22c63fe73b10933f655f86a1a2d55976f609da68361ee5863252702f`	pdf-objstm-decoded	PDF /ObjStm 75 0 obj (inflated)	982 bytes
`font_00_sfnt_off00000eb5.bin` `f39f99e2d4b021d4eac703afe26d32ad26f128c442f2089910c21b1f323fc85d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB5	79301 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.