Malicious PDF — malware analysis report

Static analysis result for SHA-256 58b3c804975ab8f3…

MALICIOUS

PDF

1.9 KB
MD5: 5b556ed377644a71e91de1f2661f4748 SHA-1: 70ad0ac42d970fbb95c6bc9606c4427f23ad9958 SHA-256: 58b3c804975ab8f3a528fdc2bdb67b9304346ebe079fe0dd23dd7faa1731e819
178 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. A critical heuristic identified the CVE-2009-4324 vulnerability related to media.newPlayer, suggesting the JavaScript is designed to exploit this flaw. The JavaScript code itself appears obfuscated, but the presence of unescape() calls and the overall structure point towards an attempt to download and execute a secondary payload. The ClamAV detection further confirms its malicious nature.

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009.
  • ClamAV: Pdf.Exploit.JSCode-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.JSCode-1
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
ee0ef96f5791faa838a79706f192c65408f7e38933d10461e07755e9b0d0a0a7		 pdf-javascript-stream PDF /JS object 5 at offset 0x117 1451 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
javascript_obj0005_001.js
01acc3e630221af1b21990637a7ed81920b5e91f9196e67f7503a1b50346110b		 pdf-javascript-stream PDF /JS object 5 at offset 0x117 39 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.