MALICIOUS
184
Risk Score
Malware Insights
The PDF contains embedded JavaScript and triggers a critical vulnerability (CVE-2010-2883) related to Adobe Reader's CoolType SING font handling. This indicates the document is designed to exploit this specific flaw to execute arbitrary code. The presence of multiple JavaScript-related heuristics and the ML classifier's high confidence further support this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9985
Heuristics 8
-
Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
-
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGEA valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.datanumen.com/apdfr/
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0040_000.js3ca8baa7e278be94234683c381f48d1b51b017abe02d6c46c3a24d88d09438bc |
pdf-javascript-stream | PDF /JS object 40 at offset 0x20DA | 12401 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s).
|
|||
stream_001_off00000aef.bin0f910ffeec733940f6ba1ae41dc6770eab5d615c05bccc95197878b62c8dc45f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xAEF | 2928 bytes |
stream_002_off00000e4d.bin29cf1edfedd4f27f3c450646c5dc2510e6bf9e63eee1cd436ac517a465a2e1bf |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xE4D | 1650 bytes |
stream_003_off000011bc.js672d461752be4a970c8e9721164ce074d252b55d09d46cc09259d2ce4fc09f7f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11BC | 1546 bytes |
stream_010_off00005a6c.binfe122a09d8a0444608fdc5a6f4981a2dbd469f5bbfacb4bdd327c28ccc343e13 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x5A6C | 149 bytes |
stream_011_off00005b20.bin4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x5B20 | 56 bytes |
font_00_cff_off000083e8.binea8f409c7366ed46eeb553aa7b404f04641f482ba88463fbe253da60be5787e5 |
pdf-font-stream | PDF embedded font (cff) at offset 0x83E8 | 1138 bytes |
polyglot_child_pdf_off0003c00f.pdfaa94c85b084fb14269b09681593bf2bac58d9f2c21ecfc095f553345336e0fb6 |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0x3C00F | 384539 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.