Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f2a6aa56ac78d30…

MALICIOUS

PDF

233.9 KB Created: ´s4c2Ÿùzúb¦Óò¨õƒdX&篠ü‡Øæà…ïڅmJ‡’ƒºÿõ[ =¨ó
MD5: 851d895614645756999bd9f6e002c127 SHA-1: 310b48749a3112aa0a7905ebe1674b1aed6fe6b3 SHA-256: 4f2a6aa56ac78d30292f86330306de9dbc6e0c6b645cc887f637504bcad259b3
466 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains multiple critical exploit indicators, specifically targeting Adobe Reader vulnerabilities CVE-2010-2883 and CVE-2010-1297. The embedded JavaScript, when deobfuscated, appears to be designed to exploit these vulnerabilities to execute arbitrary code. The presence of ClamAV detections and ML classification further supports its malicious nature. The script's primary function is to exploit these vulnerabilities to download and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 14

  • Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883
    PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
  • Adobe Flash authplay SWF exploit in PDF — CVE-2010-1297 critical CVE likely CVE_2010_1297_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, a crafted SWF with ActionScript prototype/AVM-era markers or the AES-PHP/authplay variant markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-1297 in Adobe Reader's bundled authplay.dll.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Dropper.Agent-1507058 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1507058
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.1/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
8.swf
672e4c5bd34252ddf166860c9875ca782cd8bf35579622ce76be025c6612b25c		 pdf-embedded-file PDF EmbeddedFile object 47 at offset 0x432D 2557 bytes
javascript_obj0026_000.js
e0c8c4a3d109e26e516895e3cc64b079198933b9fd9c2f4eb022c8086e2cd8a4		 pdf-javascript-stream PDF /JS object 26 at offset 0xD48 26519 bytes
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: unlikely
stream_000_off0000014a.bin
69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14A 434 bytes
generic_stage_recovery_000.js
2817aad980b82d160ee2baaebdd228932981c26a836571e054821677e37bfb16		 deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 26 at offset 0xD48 24410 bytes
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: unlikely
font_00_sfnt_off000021f5.bin
1e827515a464087cdace63e3578c118b45a657ed40cdbb9de7eead35c9b593ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21F5 7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.