Malicious PDF — malware analysis report

Static analysis result for SHA-256 72477060170b5514…

MALICIOUS

PDF

674.1 KB
MD5: 8e3b08a46502c5c4c45d3e47ceb38d5a SHA-1: 04bd584d01658ac185500bec263cc1ed449dcff3 SHA-256: 72477060170b55145c69fc47079683b94bc918fa318f591efa26c67971cd00a2
316 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF sample is identified as malicious by multiple heuristics, including a critical firing for CVE-2013-0640, which indicates exploitation of a known Adobe Reader vulnerability. The embedded JavaScript, which uses eval() and unescape() functions, is designed to execute arbitrary code. The primary function of the script is to exploit this vulnerability, likely to download and execute a secondary payload, as suggested by the 'Pdf.Dropper.Agent' ClamAV detection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Adobe Reader XFA oneOfChild exploit - CVE-2013-0640 critical CVE likely CVE_2013_0640
    PDF contains the CVE-2013-0640 XFA trigger shape: JavaScript retains an XFA choiceList object, mutates keep.previous to contentArea, then reattaches the object through oneOfChild after a timer-driven heap setup.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Dropper.Agent-5493317-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-5493317-0
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/3.0/
    • http://www.xfa.org/schema/xfa-template/2.8/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js
dbf2b563944354536cd472733310ee3c9e5780686e4e5cd639764efd7ba740c1		 pdf-javascript-stream PDF /JS object 1 at offset 0xA 67070 bytes
stream_000_off00047995.js
dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x47995 289498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.