PDF malware analysis — malicious · 698294f4fae6edae

MALICIOUS

PDF

167.7 KB

MD5: 11d9b468dcf893c715c196fc81df1ed0 SHA-1: 25dd5549a504d5450162e8ca24dfd4938f0e6c95 SHA-256: 698294f4fae6edae3a600bcedc97e4718617a737a05cddf4111a4e9e946d2f98

238 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document exploits the CVE-2010-2883 vulnerability in Adobe Reader, leveraging embedded JavaScript to achieve code execution. The critical heuristic 'PDF_JS_EXPLOIT_CLUSTER' and the presence of a 'generic recovered JavaScript exploit stage' indicate that the primary purpose is to download and execute a secondary payload. The obfuscated JavaScript, while not fully decipherable, strongly suggests malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9738

Heuristics 9

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.1/

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0029_000.js` `caedd7afb8f8a40229748acd168968f4e03755decf202f1be90d7b1733133d7f`	pdf-javascript-stream	PDF /JS object 29 at offset 0x2850D	14983 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`javascript_obj0038_001.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 38 at offset 0x1D44	1242 bytes
`javascript_obj0039_002.js` `d8bbcc5984e6bec8996e18881fad0486ff520c9b9f03ee0fb9694ddfc412340d`	pdf-javascript-stream	PDF /JS object 39 at offset 0x2316	1572 bytes
`stream_004_off00000cd0.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xCD0	434 bytes
`generic_stage_recovery_000.js` `25d9dad5dc20791e30140db686bef9d58070630b8e87d292d7e9e30965a968af`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x2850D	17479 bytes
`generic_stage_recovery_001.js` `905e7d5647095f05d02df1717bf57d5a0180749bc68ee0327b04ac6b7ae24ebf`	deobfuscated-js	generic stage recovery marker-MM-to-%u from combined JavaScript objects at offset 0x2850D	10357 bytes
`font_00_sfnt_off00001313.bin` `fc85f44193ccd402987935418c4f5fdf6802c96450b789e7fce04f9791933021`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1313	7965 bytes
`font_01_sfnt_off00001ac5.bin` `1e827515a464087cdace63e3578c118b45a657ed40cdbb9de7eead35c9b593ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1AC5	7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.