PDF malware analysis — malicious · 5312e687f76cc89a

MALICIOUS

PDF

102.3 KB

MD5: 352ecbb5c180268fad2ccd6b0e3e1b97 SHA-1: 0c08d47c6010aba8a204a0da69a95e7431236858 SHA-256: 5312e687f76cc89a41b5a0492353f0db2a0e5430065a2e86b4a310116046008f

184 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious File T1059.001 PowerShell

This PDF file contains embedded JavaScript and RichMedia (Flash) content, specifically triggering the CVE-2011-0611 vulnerability. The ML classifier strongly indicates maliciousness. The embedded Flash content likely serves as the initial exploit vector, leading to the execution of further malicious code, potentially a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9969

Heuristics 8

Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA

PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`5.swf` `797559d3f1e4f62f7d7ec5a729b60c863e13118d22afb32eab08faf38dc7c87f`	pdf-embedded-file	PDF EmbeddedFile object 50 at offset 0x40C5	2809 bytes
`javascript_obj0029_000.js` `536586c90bea0f66d69d7236e72838465d09d9fdb3a201227bb8414e274eaa76`	pdf-javascript-stream	PDF /JS object 29 at offset 0x175B5	19788 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`javascript_obj0039_001.js` `79a847f48c29830c80cf0408c7505d8bd07472b58ec4ea49698a533638d7bb04`	pdf-javascript-stream	PDF /JS object 39 at offset 0x1E9B	5637 bytes
`javascript_obj0056_002.js` `2b0cb364300292a88607c7b04076629077f1b58bbf9fa93686a58f4ad62ef40b`	pdf-javascript-stream	PDF /JS object 56 at offset 0x32FA	1417 bytes
`stream_004_off0000088f.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x88F	434 bytes
`font_00_sfnt_off00000e51.bin` `9520d1e3c26c38a7d8e0587578a21196782149e3c5f4b565229deafde3ff3a35`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE51	8429 bytes
`font_01_sfnt_off00001663.bin` `18f2d21f655a09be0df9f6bfb4b539e43160f5a64a3e1b2dd7a4c8a5a185a5d2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1663	8429 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.