PDF / .TMP malware analysis — malicious · 5a0e9e5eaa6f21b1

MALICIOUS

PDF / .TMP

360.6 KB

MD5: 7320d8dbeb89f6c4c0ad6d3910341e8e SHA-1: 8ece72e38516e4b8222a6989ad19c044f927d19a SHA-256: 5a0e9e5eaa6f21b1b89766dcdb82b34fc81e1482e3f94ceaf931bf022efe820d

178 Risk Score

Malware Insights

MITRE ATT&CK

T1204 User Execution: Malicious File

The sample is a PDF file that contains embedded JavaScript, which is a common technique for delivering malicious payloads. The critical heuristic firing for CVE_2009_4324 indicates exploitation of a known vulnerability within the PDF reader. The embedded JavaScript stream, combined with the unescape() call and the polyglot nature of the file (containing a secondary embedded PDF), strongly suggests the execution of a malicious script. The script's likely intent is to download and execute a second-stage payload, although the exact details are obfuscated.

Heuristics 7

media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324

PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/pdf/1.3/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0057_000.js` `eae10c2d1846ed108dbd322fa8001738199732b4fe8b3355e360a1f3532eb5fd`	pdf-javascript-stream	PDF /JS object 57 at offset 0x551F	2102 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`stream_005_off00000b74.bin` `e4217c167299ac63f64b8b7e903cc0196f0828693d273431b8b793a12ed0fed3`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB74	1000 bytes
`objstm_0053_00.bin` `f9797d0fa28384c30d8bf1da89163104ce539753e417fa1f9c5fd135d1eceb39`	pdf-objstm-decoded	PDF /ObjStm 53 0 obj (inflated)	50 bytes
`polyglot_child_pdf_off00053667.pdf` `19a460963f66e25a89b47cb1971eb13098f8d69d76275e5e2a273e2e7ae1fdfb`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x53667	27598 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.