MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF file contains embedded JavaScript and triggers a critical heuristic for CVE-2009-4324, indicating an attempt to exploit a vulnerability in PDF readers. The embedded JavaScript is likely responsible for executing malicious code, potentially leading to further compromise. The presence of benign URLs does not detract from the malicious nature indicated by the exploit heuristic.
Heuristics 4
-
media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/pdf/1.3/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objstm_0023_00.bina8ae5782d4bda67f769039360ac952b75b2fc35dbe59db420533f2e2bbd9095a |
pdf-objstm-decoded | PDF /ObjStm 23 0 obj (inflated) | 274 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.