Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b122da2ab317e88…

MALICIOUS

PDF

79.1 KB
MD5: 656b3f79ab3c0d6a15a639fc6306cad7 SHA-1: 998a94ec8c27f7fbfb27ba8f6796227a60018da9 SHA-256: 5b122da2ab317e880af407c884d379062096993f317482eab66e331331ac282c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2009-4324 via the media.newPlayer annotation. This JavaScript is designed to download a second-stage payload from the URL http://ezuis.in/x/l.php?s=newp&&. The ML classifier strongly indicates maliciousness, and the presence of shellcode download URLs further supports this. The script's primary function is to facilitate the download and execution of further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ezuis.in/x/l.php?s=newp&&

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
a907c3cfd73cad9dc53d345db917414f3c95c92276104b6b674581c2aa0faf68		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 3583 bytes
javascript_obj0008_001.js
e353a5713dfdca1f2180d4b6294eaf5cd7d2ed7ae2d40c8fbc6d9dfdac742870		 pdf-javascript-stream PDF /JS object 8 at offset 0x209 80451 bytes
legacy_pdfkit_stage_000.js
a269e935e0b7c56d38baff9b1dd992d545670e3a8c288813c902c4d704a17ef3		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x101A 2552 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
legacy_pdfkit_stage_001.js
42025b552c7960b53abcd8cd732b01c8d109eccfdfefc352b9826c4d5807d414		 deobfuscated-js cross-stage annotation API aliases at offset 0x1E7 81 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.