Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ddda4e9abd6df77…

MALICIOUS

PDF

597.0 KB Created: 2009-04-07 11:32:57 -04:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.3) First seen: 2026-05-11
MD5: e892ec8d8daea5f65c629fbaa490c6e0 SHA-1: b054439b96f000e6f9b8cd5a1a2a4fa20c4ae49d SHA-256: 4ddda4e9abd6df77c8e350c689c09e67473ba0476a953b758bd776a2f6cf6548
618 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File Execution: Malicious Link T1059.003 Command and Scripting Interpreter: Windows Command Shell

This PDF file contains embedded JavaScript and a PE payload, indicating malicious intent. The 'SE_CLICKFIX' heuristic suggests a social engineering attack where the user is prompted to execute a command, specifically targeting 'cmd.exe'. The embedded PE payload was detected by ClamAV as 'Win.Trojan.ShellcodeReverseTcp-1', and the PDF itself was identified as 'Pdf.Tool.Agent-1388586'. The document body contains what appear to be accessibility-related keywords, possibly as a lure or to blend in with legitimate content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9829

Heuristics 14

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\gnome-access-guide.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mielke.cc/brltty/ In PDF document text
    • http://mielke.cc/brltty/releases/In PDF document text
    • http://mail.gnome.or)18(g/mailman/listinfo/orca-listReferenced by PDF JavaScript
    • http://mail.gnome.or)18(g/archi)25(v)15(es/orca-listReferenced by PDF JavaScript
    • http://l10n.gnome.or)18(g/teamsReferenced by PDF JavaScript
    • http://l10n.gnome.or)18(g/module/orcaReferenced by PDF JavaScript
    • http://li)25(v)15(e.gnome.or)18(g/Orca/Braille#BrailleReferenced by PDF JavaScript
    • http://libr)10(ar)-30(y)100(.gnome)15(.org/users/user-guide/stab)20(le/shor)-40(tcuts-global.html.enReferenced by PDF JavaScript
    • http://b)20(ugzilla.gnome)15(.org/sho)15(w_b)20(ug.cgi?id=548169Referenced by PDF JavaScript
    • tcp://10.192.144.26:443In extracted file (gnome-access-guide.pdf)
    • http://bugzilla.gnome.org/buglist.cgi?query=product:orca+In PDF document text
    • http://bugzilla.gnome.orgIn PDF document text
    • http://developer.gnome.org/tools/svn.htmlIn PDF document text
    • http://mail.gnome.org/mailman/listinfo/orca-listIn PDF document text
    • http://mail.gnome.org/archives/orca-listIn PDF document text
    • http://l10n.gnome.org/teamsIn PDF document text
    • http://l10n.gnome.org/module/orcaIn PDF document text
    • http://live.gnome.org/Orca/Braille#BrailleIn PDF document text
    • http://library.gnome.org/users/user-guide/stable/shortcuts-global.html.enIn PDF document text
    • http://bugzilla.gnome.org/show_bug.cgi?id=548169In PDF document text
    • http://pfaedit.sf.net/In extracted file (font_05_type1_off00059827.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
gnome-access-guide.pdf pdf-embedded-file PDF EmbeddedFile object 3400 at offset 0x8FD4A 37888 bytes
SHA-256: 047b713b434b197afac01e2d7137fe016ecd55bf6a55b1e0fa963bbd9e58397b
Detection
ClamAV: Win.Trojan.ShellcodeReverseTcp-1
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=gnome-access-guide.pdf; kind=pdf-embedded-file Static shellcode analysis recovered the Metasploit stager connect-back address: 10.192.144.26:443 (reverse/x86, lab (non-routable)) Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_MSF_BIND, SC_PUSH_STRING Static shellcode analysis recovered API/import strings: GetProcAddress, ExitProcess, LoadLibraryA, VirtualAlloc Static shellcode analysis recovered command string(s): cmd
javascript_obj3401_000.js pdf-javascript-stream PDF /JS object 3401 at offset 0x94A26 67 bytes
SHA-256: 0873ba271bf4c5b02fa109cb4dc10c00ca519aa0dcd5292fcd43d06b79d1add2
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "gnome-access-guide", nLaunch: 0 });
stream_086_off00062ee9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x62EE9 21739 bytes
SHA-256: 9143d5c6371d54f01c98864c692cc15bf25a5bb4eae54031307b5213ae9e4711
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
font_00_type1_off0004d704.bin pdf-font-stream PDF embedded font (type1) at offset 0x4D704 1476 bytes
SHA-256: f41f89a5a793184868e4cd1985ff0c150cb4a00d90304179316be0d81dba5403
font_01_type1_off0004dd3c.bin pdf-font-stream PDF embedded font (type1) at offset 0x4DD3C 14228 bytes
SHA-256: 11cbe6479868509e3493465689d5d5d6fae7d2dbc71fb8aaeb21d737e47c923f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.92, consistent with packed or encrypted content.
font_02_type1_off0005139f.bin pdf-font-stream PDF embedded font (type1) at offset 0x5139F 16469 bytes
SHA-256: c2d952cc9773db5bfedb254540728d961707cde6ff51c8520eaaef65d278fa46
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.93, consistent with packed or encrypted content.
font_03_type1_off00055319.bin pdf-font-stream PDF embedded font (type1) at offset 0x55319 4848 bytes
SHA-256: ec42cf910fa8626b316ad94e8f1be5085504186df09b6027bf9f78fca1436430
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.53, consistent with packed or encrypted content.
font_04_type1_off00056438.bin pdf-font-stream PDF embedded font (type1) at offset 0x56438 13489 bytes
SHA-256: a2647632d9bad114531ee14d15c16c22f1b97ccbe9da99f242bdadcb53329ffc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.91, consistent with packed or encrypted content.
font_05_type1_off00059827.bin pdf-font-stream PDF embedded font (type1) at offset 0x59827 11354 bytes
SHA-256: ce1ecf9505ca71de45fc67b184dae00bd3cd7adb5241ab44376c7ed945c9b05f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.94, consistent with packed or encrypted content.
font_06_type1_off0005c570.bin pdf-font-stream PDF embedded font (type1) at offset 0x5C570 10500 bytes
SHA-256: ce284a281d79ee67dce0356b280f064e330ab98e032d18832d7f96cdc904e5f3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.93, consistent with packed or encrypted content.
font_07_type1_off0005eef9.bin pdf-font-stream PDF embedded font (type1) at offset 0x5EEF9 16594 bytes
SHA-256: 3fef4d2c8c36588a0e94ac5b595f561bc6ad908cb306215ef84b3bdc59c06681
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.94, consistent with packed or encrypted content.
font_09_type1_off000683a3.bin pdf-font-stream PDF embedded font (type1) at offset 0x683A3 15784 bytes
SHA-256: 667a01adc63a599eb7df3d8d991f20a5a5b9ee97ccde4ef4add88c2122dc7332
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.93, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.