Malicious PDF — malware analysis report

Static analysis result for SHA-256 78673b184738f321…

MALICIOUS

PDF

59.8 KB First seen: 2026-05-10
MD5: 0c2bb9d6c96028f174c74ef6488ab515 SHA-1: f627b6ce401a1913abc54f775c5650c971367464 SHA-256: 78673b184738f321c66e7ff7f4ba34183bbb88eae7e6f58a627f44d89f09e11b
110 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains embedded XFA forms and triggers a critical heuristic for CVE-2010-0188, an integer overflow vulnerability in LibTIFF used by Adobe Reader. This exploit typically leads to the execution of shellcode, which is also detected within the sample. The embedded file and ML classifier further support the malicious nature of this document, indicating it's designed to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Adobe Reader XFA LibTIFF integer overflow — CVE-2010-0188 critical CVE exact CVE_2010_0188
    An XFA image field carries a TIFF whose IFD has a malformed tag that overflows the LibTIFF parser (CVE-2010-0188).
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/ In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x51 13450 bytes
SHA-256: 480b553d8ac0461da1d6ba0718dd7cd2f050ad5dae907c59245d1130d15d3040
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x586 8658 bytes
SHA-256: a8b6c73286045baa796115c26819419dc24604f178a059ca75d2cd793188f119

Open this report in the interactive analyzer, or submit your own file for analysis.