PDF malware analysis — malicious · 684c714b82d3c94b

MALICIOUS

PDF

45.0 KB

MD5: e06d17d7d9f9170e65524f12d6547ddc SHA-1: 6ce77e5b942d8be4415137652f2ec25e5a3643bb SHA-256: 684c714b82d3c94bf5ac32e9c83d42831de8af31bdb0737557f148e5db03bb3a

336 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2010-2883, a known Adobe Reader vulnerability. The script attempts to download a second-stage payload from the URL http://afreelis.net/nte/avorp1vena.php/yUa89f46e4H8b676ac8V03f01036002R217256a6102Tc7d13c22Q00000000901801F00000000J15000601l0c0a327. This behavior is consistent with a downloader or initial access exploit.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 10

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://afreelis.net/nte/avorp1vena.php/yUa89f46e4H8b676ac8V03f01036002R217256a6102Tc7d13c22Q00000000901801F00000000J15000601l0c0a327
- http://www.bitstream.com
- http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `752911708a37b8d4a16f5a3cec0424dc6b8c549034afd529daec955c04018e03`	pdf-javascript-stream	PDF /JS object 12 at offset 0xA0BA	4012 bytes
`javascript_obj0012_001.js` `c90805238d05feb776973158c183c7d32a4e3b6d0fe04c8ac938ff47144a700f`	pdf-javascript-stream	PDF /JS object 12 at offset 0xA100	4898 bytes
`generic_stage_recovery_000.js` `3c6d7e165eade8aceb9a1737833c1eeaea78a0d49e0ff3388cd9413b44994460`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 12 at offset 0xA0BA	3962 bytes
`generic_stage_recovery_001.js` `23b2d5a06e21c615e8befee1dfaa52cb1b1fe2da77884fc88f653e25d5c9b25d`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 12 at offset 0xA100	4848 bytes
`generic_stage_recovery_002.js` `4ab290ea37a4e9b0cf6413a1cf8fc29fb1c55b9617146b5775e9557085bfb47b`	deobfuscated-js	generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0xA0BA	8811 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_003.js` `a5bad64a2a375404f2970ed682395815cea2280c3d096e5ebd02f59b8f9be70f`	deobfuscated-js	generic stage recovery split-literal-normalize from decompressed stream at 0x0 at offset 0x0	46062 bytes
`generic_stage_recovery_004.js` `87613e8f4110d7c8a5507bd452e7b386da230355ee27816ec8cbeccaa131ad07`	deobfuscated-js	generic stage recovery percent-decode from decompressed stream at 0x0 at offset 0x0	46110 bytes
`generic_stage_recovery_005.js` `52c550c75d481d30ab8a71adf59f41b0cb25a1ebb9824f77e4433028d6299f7b`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from decompressed stream at 0x0 at offset 0x0	46060 bytes
`font_00_sfnt_off0000033c.bin` `683fcffe9abaad29001e134bdd9ad7d1628d5cbbf628c451b6c621f202a7dae4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x33C	65932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.