PDF malware analysis — malicious · 6941b5608a48f10d

MALICIOUS

PDF

204.1 KB Created: 2010-09-24 17:00:51 Authoring application: Advanced PDF Repair at http://www.datanumen.com/apdfr/

MD5: 53dd2cefc7eecbeff43aad1bce9e9b7d SHA-1: 3db181fb76099fe009846b5a1e99bd5b8fc324a6 SHA-256: 6941b5608a48f10dee61a45830c2dedfc74b04903ffd4826321a6c2d6aaaffb9

278 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits CVE-2010-2883, a known vulnerability in Adobe Reader. The JavaScript is heavily obfuscated but appears to be a stage recovery mechanism for a larger exploit. The presence of 'Js.Exploit.Shellcode-18' from ClamAV further supports the malicious nature of the embedded script, which is likely designed to download and execute a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9899

Heuristics 9

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.datanumen.com/apdfr/
- http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.1/

Extracted artifacts 16

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0038_000.js` `658faddc161b3e6edcfc211655065eab4714802e59be20862424972848e79952`	pdf-javascript-stream	PDF /JS object 38 at offset 0x289F	14983 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`javascript_obj0045_001.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 45 at offset 0x6A67	1242 bytes
`javascript_obj0046_002.js` `d8bbcc5984e6bec8996e18881fad0486ff520c9b9f03ee0fb9694ddfc412340d`	pdf-javascript-stream	PDF /JS object 46 at offset 0x6C8B	1572 bytes
`javascript_obj0038_003.js` `b575f5b8c1f551a653660dea13387b26e0718fa76b518e7dd6de732565550369`	pdf-javascript-stream	PDF /JS object 38 at offset 0x28C1	198517 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`stream_000_off00000938.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x938	434 bytes
`generic_stage_recovery_000.js` `021fa36ce8b14b10c33290f7b4f4b3a27b9002828f54e1bba17d8ff964abb260`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x289F	215997 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_001.js` `3cb329d4860e808db9ecd8eb529ec815858e0c0e1147dbcdcd6d7c5186d8c93b`	deobfuscated-js	generic stage recovery percent-decode from combined JavaScript objects at offset 0x289F	215987 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_002.js` `7f57423f004af26031ac65a2109d646e92fb8e755dd1438c560931f50deae4a9`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x289F	208875 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_003.js` `6c5e417b54155adae97e5d0f60fbe1f0d254dfe22f62a6b1f537b3228403f2fc`	deobfuscated-js	generic stage recovery percent-decode from combined JavaScript objects at offset 0x289F	208865 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_004.js` `0b3f6bfe514bd164c96822ba4f18f2fc02c52235648ec980bce48ed49a4f9d5c`	deobfuscated-js	generic stage recovery split-literal-normalize -> marker-MM-to-%u from combined JavaScript objects at offset 0x289F	215994 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_005.js` `1ce0b722812c5fcd276f3be1d2a011c688f7c2fc2434643eb62bfdf62e46c7d2`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x289F	215984 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_006.js` `09debd620788193569e14cc2274bebd05a16bbc9e79ec62db48d8b3473d8b5da`	deobfuscated-js	generic stage recovery split-literal-normalize -> marker-MM-to-%u from combined JavaScript objects at offset 0x289F	208872 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`generic_stage_recovery_007.js` `7bfd6e270e43ba26c27be82d31e5cb24884dafaf4ea072aa16e41a9ed77c8da9`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x289F	208862 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: unlikely
`font_00_sfnt_off0000642f.bin` `fc85f44193ccd402987935418c4f5fdf6802c96450b789e7fce04f9791933021`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x642F	7965 bytes
`font_01_sfnt_off0000668e.bin` `1e827515a464087cdace63e3578c118b45a657ed40cdbb9de7eead35c9b593ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x668E	7965 bytes
`font_02_sfnt_off000068ed.bin` `823021e67c69104f3db2966cb1f6abc7103a6715ef1bffc315b5f9c5ea04a787`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x68ED	7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.