Malicious PDF — malware analysis report

Static analysis result for SHA-256 608767bd29f1cb1b…

MALICIOUS

PDF

3.3 KB
MD5: 762c1527baffc66a8045a0cffef757b6 SHA-1: 974d23366bad3b663e41337347dd3094d78a0c2d SHA-256: 608767bd29f1cb1b85d02980bd48ea43fc919d6fc426f8880a5ddb6313ada86e
146 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits the CVE-2009-0927 vulnerability using the Collab.getIcon method. The JavaScript is heavily obfuscated but appears to be a stage recovery mechanism, indicating it's designed to download and execute a further payload. The ML classifier strongly flags this as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
85668e87d02161f787ae3cd451ccab1d780fd39d13e53dd5aef17db61630428e		 pdf-javascript-stream PDF /JS object 7 at offset 0x2A5 2403 bytes
generic_stage_recovery_000.js
17ba61e2635048269af19ba13ddf3522ee59bbc3c25db7d3ebe7cc1f8f7d9dcb		 deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 7 at offset 0x2A5 2400 bytes
generic_stage_recovery_001.js
527d60f3959b801bda98a88444b849458b255401168aee3e6fb0fdafc4548d38		 deobfuscated-js generic stage recovery percent-decode from JavaScript object 7 at offset 0x2A5 2395 bytes
generic_stage_recovery_002.js
0a7b19f8573d659e40b25994765352307f9e247aed3cb908998737cd5816bf63		 deobfuscated-js generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x2A5 2416 bytes
generic_stage_recovery_003.js
c11b4636381b848bbbb6076681f3b8134d01fe69bf5fb9b08b38435657791512		 deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x2A5 2411 bytes
generic_stage_recovery_004.js
a453538b902ae926100457025ffd8dff35149cc905b92e10773652b4ac526ab3		 deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from JavaScript object 7 at offset 0x2A5 2392 bytes
generic_stage_recovery_005.js
5c5de7954c8d2d82f3c3b9271f60692bfa9a48c6d724dcb4d371d4afaf12f97a		 deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x2A5 2408 bytes
combined_document_js_000.js
af32854ac0b8fd01871864c196b9ac3fdc4b8aafe3aea4817e99b3f10ab3f130		 deobfuscated-js combined document JavaScript streams at offset 0x2A5 2419 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.