Malicious PDF — malware analysis report

Static analysis result for SHA-256 62d4721a078e06e9…

MALICIOUS

PDF

1.8 KB
MD5: aa3dd5089eaf6d72dd146ad1cf3a4f03 SHA-1: b2b9d87b1d77b1d1c5c2f65007aad589b417b91b SHA-256: 62d4721a078e06e9df8b837869c2a724af6fb7a2d2b088f2229948805544c6a2
194 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains embedded JavaScript that utilizes the util.printf function, indicating exploitation of CVE-2008-2992. The JavaScript code appears to be obfuscated but contains a reconstructed URL, 'http://192.168.1.1/download/payload.exe', which is likely used to download a second-stage payload. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Pdf.Dropper.Agent-7596700-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7596700-0
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
93f34bb50aca717eaf8ee4291193046756e45ed150a5d2aa8f2af51200210d10		 pdf-javascript-stream PDF /JS object 6 at offset 0x138 1333 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.