PDF malware analysis — malicious · 45b7413b01f1518b

MALICIOUS

PDF

44.7 KB

MD5: 7c983a45eaa32b4a9c067134c01e5785 SHA-1: 6fb294b090ef1936b69843ee90d51e0185d4c7be SHA-256: 45b7413b01f1518b647c4a50bdac7702f0ec949196d7e1b2df0f5178d58aa3e7

104 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: Malicious Link T1059.001 Command and Scripting Interpreter: PowerShell T1059.007 Command and Scripting Interpreter: JavaScript

The PDF sample contains embedded JavaScript and leverages the CVE-2010-2883 exploit targeting Adobe Reader's CoolType SING font parsing. This exploit allows for arbitrary code execution, which is typically used to download and run a secondary payload. The presence of XFA form elements and JavaScript actions further supports this attack vector. While specific URLs are present, they are not directly indicative of a payload delivery mechanism in this analysis.

Heuristics 6

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `0d4554251cef7e616993d7a363d943fd92e8a0176f9cb20e82fafc59c162d7f7`	pdf-javascript-stream	PDF /JS object 12 at offset 0xA0BA	3718 bytes
`font_00_sfnt_off0000033c.bin` `683fcffe9abaad29001e134bdd9ad7d1628d5cbbf628c451b6c621f202a7dae4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x33C	65932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.