Malicious PDF — malware analysis report

Static analysis result for SHA-256 798bf8b6ed3a7175…

MALICIOUS

PDF

639.0 KB Created: A  bg÷Z(KîÎ 3Ï¢{zêdFÚû°·4(‹<þ–ñKWÕC(ßcƒ ì  ³8 Authoring application: ”°?ÝV_˜Ýk­þ.§Ë£h”<$oƘ-=}ŽN‡®y‡ G•"¤œ*š (via 5nD³Aõì?Oó¿¥Èѯ&/ZVœµŒ¼õýÚ³]¨«°Bëð;ÑzUf) First seen: 2022-03-20
MD5: 91ae50066626182b6a5876e4562dd752 SHA-1: 8cebd32ba89e6cb9f346001b5baf6a918779cf8b SHA-256: 798bf8b6ed3a717567a817c9464c7483ae1ca136577105df8c6adfdf01310fe6
244 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document exploits CVE-2010-2883 via a JavaScript heap spray. The embedded JavaScript, though partially obfuscated, attempts to download a payload from 'http://cgi.adobe.com/special/acrobat/update'. The ML classifier and critical heuristic firings strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 9

  • Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883
    PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.4/Referenced by PDF JavaScript
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 23

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0012.bin pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x18D1 86 bytes
SHA-256: f7ee3ef2f8f35d669a6c2b8b0b0ee89655bbc3d04b107a8d22531830f6fc28a1
embedded_file_obj0013.bin pdf-embedded-file PDF EmbeddedFile object 13 at offset 0x1985 1500 bytes
SHA-256: 8aa38aa66bbb66c238f2b2056e2706e71575fe988694258f17d2bf9e80eb10af
embedded_file_obj0014.bin pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x1C59 7249 bytes
SHA-256: 742512912da916ed05162ec3e4d245ac05b5310121e973ea4cc4bebeeaa6cc67
embedded_file_obj0015.bin pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x26B1 159 bytes
SHA-256: da19a956510de42d8522c11b25445b3efa52056541ed94d34b6ccf27c6a9ff47
embedded_file_obj0016.bin pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x2784 3023 bytes
SHA-256: 7a3baf6cd7005199e771f5fac95d2162e961b145b52976bfa7d0f32a10c9758d
embedded_file_obj0017.bin pdf-embedded-file PDF EmbeddedFile object 17 at offset 0x2B15 200 bytes
SHA-256: 4cb349134bdb5f1a1c03281df9b53128ebe947f235398a912a4f0a9f638b24d5
embedded_file_obj0018.bin pdf-embedded-file PDF EmbeddedFile object 18 at offset 0x2C09 1223 bytes
SHA-256: 94561903baadce077f2e3349478a5382a04b3be500869799a4aabc53a7a9fcb6
embedded_file_obj0019.bin pdf-embedded-file PDF EmbeddedFile object 19 at offset 0x2E5D 80 bytes
SHA-256: 2ebdd7efeaa1190ff6bad8cbd649b313e3969564018f204e7385b97c2fab1e19
embedded_file_obj0020.bin pdf-embedded-file PDF EmbeddedFile object 20 at offset 0x2F07 56 bytes
SHA-256: 4a60a9864cdf7382475d51051a03fdc43b32c31eb508893ccfccece34957f9f1
eflow.jpg pdf-embedded-file PDF EmbeddedFile object 38 at offset 0x391C 24941 bytes
SHA-256: ba37fe16834bd85f967613ae35e857f09094a0b2d63ee89c455d639970a0e813
javascript_obj0040_000.js pdf-javascript-stream PDF /JS object 40 at offset 0x9B6CE 2844 bytes
SHA-256: bb2fe1c0b366bd3a48235c04e822305ef3ab04e575e155f93e34004f56cc10ec
Preview script
First 1,000 lines of the extracted script
�� i f   ( t y p e o f ( t h i s . A D B E )   = =   " u n d e f i n e d " ) 
       t h i s . A D B E   =   n e w   O b j e c t ( ) ; 
 A D B E . L A N G U A G E   =   " E N U " ; 
 A D B E . V i e w e r _ s t r i n g _ T i t l e   =   " A d o b e   A c r o b a t " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ D e s c   =   " A d o b e  N�N��hSUf�e� " ; 
 A D B E . V i e w e r _ s t r i n g _ U p d a t e _ R e a d e r _ D e s c   =   " A d o b e   R e a d e r   7 . 0 . 5 " ; 
 A D B E . R e a d e r _ s t r i n g _ N e e d _ N e w _ V e r s i o n _ M s g   =   "kd   P D F  e�N���lBf���rHg,v�   A d o b e   R e a d e r0 ��c	  xn[�  geN �}g e�rHg,� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 c	  xn[�  ��S�W(~�N �}O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0 1   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��c	  xn[�  T/R�W(~�f�e�� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ 6 0   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 ��Y
R6N�N  QW@�  W i n d o w s�  C T R L + C�  M a c�  C o m m a n d + C�	� q6T |��4R0`�v�mO��VhN-N僷S֋�~�O�`o� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r _ O l d e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 ��Y
R6�� QW@� q6T |�^ R0`�v�mO��VhN-� b �T|�`�v�|�~�{�t TX0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 5 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  bS_ mO��Vh� ��c���SS�g e�rHg,v� Q�u0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ R e a d e r _ 6 _ 7 x   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   R e a d e r0 �}q6�hSUw �wgel�g	�� OFg�N�QC} [��EN
e�l�kc^8bg�L� u ��e�l�f>y:0 Y�g� Q~�S�u(� ��SUQ�  xn[�  N �}^v[���g e�v�rHg,0  " ; 
 A D B E . V i e w e r _ F o r m _ s t r i n g _ V i e w e r   =   "kd   P D F  �hSU��lBf���rHg,v�   A d o b e   A c r o b a t0 Y�g�l�g	f���v�rHg,� \={�kd�hSUS�N�f>y:� OFS��e�l�kc^8]�O\0 � g�N��hSUQC} u ��h9g,N
f>y:0 Y�g�S�N��c�R0   I n t e r n e t� SUQ�  xn[�  S�N �}^v[���g e�rHg,0  " ;
javascript_obj0041_001.js pdf-javascript-stream PDF /JS object 41 at offset 0x9BA1A 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0042_002.js pdf-javascript-stream PDF /JS object 42 at offset 0x9BB72 1532 bytes
SHA-256: f574e4d51594d1a8fd22e125b109b827c437aa898edc78babb62dbb93f8744f8
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_012_off000943a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x943A4 32400 bytes
SHA-256: 0601c4b533d97a420b6c976136126d6e4d79c0f357e07bcf80adaf2c57144440
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.74, consistent with packed or encrypted content.
font_00_sfnt_off0009c6f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C6F4 71524 bytes
SHA-256: 426fc31e492fe224eea571b50d4b8a8539f1b24595527e3932236df755edd36a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A)
embedded_file_obj0001_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 1 at offset 0x58; filter decode failed 112 bytes
SHA-256: d12f574c4af4fbfe357eddcef4540ac06e22a46a777fb5f3fbffd5006c36f404
embedded_file_obj0002_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 2 at offset 0x124; filter decode failed 656 bytes
SHA-256: 3968f01ae58b043d0ea847d683a6f98e25a311e0ba408dbfed2195cb6626f0f1
embedded_file_obj0003_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 3 at offset 0x411; filter decode failed 2656 bytes
SHA-256: fd9115b1f5f40cc016ea65d01a5f475b49a0454db0378209cdfebd912599017a
embedded_file_obj0004_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 4 at offset 0xECD; filter decode failed 144 bytes
SHA-256: f260041106da585936bd16590c632358ecf5430824ac7381dca09f793bab9447
embedded_file_obj0005_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 5 at offset 0xFB9; filter decode failed 848 bytes
SHA-256: ee10786e0c3045ac53b2bd9977c0f8e483c36a53a596f39af03587a986a6def8
embedded_file_obj0006_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 6 at offset 0x1365; filter decode failed 176 bytes
SHA-256: 860f460aec2bd75afe01cf4102e29ddabdbf1e22b46a86b83e231ec4333d8930
embedded_file_obj0007_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 7 at offset 0x1471; filter decode failed 528 bytes
SHA-256: 389be9ba4eb3360467918fadd28193066b4e17a4bc176b73558af08ccb48d5f2
embedded_file_obj0008_undecoded.bin pdf-embedded-file-undecodable PDF EmbeddedFile object 8 at offset 0x16DD; filter decode failed 112 bytes
SHA-256: ac0d25b31d93e1359fdef189b63b289b7cc9e794827fab6ea25ad9e9b5d74b37

Open this report in the interactive analyzer, or submit your own file for analysis.