MALICIOUS
454
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
This PDF file contains embedded JavaScript and a launch action that exploits CVE-2010-1240 to execute an embedded Windows executable. The embedded executable was identified by ClamAV as Win.Trojan.Swrort-5710536-0. The PDF also masquerades an embedded executable as a PDF file, further indicating malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 10
-
Adobe Reader Launch/export embedded executable chain critical CVE likely CVE_2010_1240_EMBEDDED_PE_EXPORTPDF combines a /Launch action with an embedded-file name tree, exportDataObject JavaScript, and embedded executable bytes. This matches the CVE-2010-1240 Launch-file abuse chain even when the Launch dictionary does not expose the stricter cmd.exe /Win shape.
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOADPDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
-
Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCHAn /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
-
ClamAV: Win.Trojan.Swrort-5710536-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Swrort-5710536-0
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
/Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JSPDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
form.pdfb4145edba5532d3b6e515cdfde1f4e42a3eae379215323ad1a78a2d91ca50ea2 |
pdf-embedded-file | PDF EmbeddedFile object 19 at offset 0x38A6 | 73802 bytes |
|
Detection
ClamAV:
Win.Trojan.Swrort-5710536-0
Obfuscation or payload:
unlikely
|
|||
javascript_obj0015_000.jseff4a0943aaff2d99cb5c8666337775c91d4d5f687782df94d2c5fc77becde7f |
pdf-javascript-stream | PDF /JS object 15 at offset 0xE542 | 53 bytes |
icc_00_off000003fb.icc2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
pdf-icc-profile | PDF ICC profile at offset 0x3FB | 3144 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.