PDF malware analysis — malicious · 7abab2832783686e

MALICIOUS

PDF

16.6 KB

MD5: 0ccc6b165fdb84316cb47fa216c28ecf SHA-1: 8a9c2c4add7dd5b9e5af530e50cdba02789afcec SHA-256: 7abab2832783686e0ccd5e76c83aed74e38debb39aae979d6216d7a494deb6a7

310 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that leverages the CVE-2009-4324 vulnerability. This JavaScript is designed to download and execute a secondary payload from the URL http://gospeltube.com/cache/.svn/.p/.l.php?l=1&spl=pdf_newplayer. The use of eval() and unescape() functions, along with string concatenation, indicates a deliberate attempt to obfuscate the malicious code.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 9

media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324

PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://gospeltube.com/cache/.svn/.p/.l.php?l=1&spl=pdf_newplayer

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj111711_000.js` `ec7bd367e106a9bb12c488e6bc2e8c5dc963662ecb782c65dd0e3df64a087d03`	pdf-javascript-stream	PDF /JS object 111711 at offset 0x18E	2977 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).
`javascript_obj111712_001.js` `7b95b31fc279b8380c2bf1ec58edbc5d9c6ed6db608fa1e938b4728ef55cfa2d`	pdf-javascript-stream	PDF /JS object 111712 at offset 0xD65	10885 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).
`javascript_obj111713_002.js` `00af60588c51a1e9d534e731c12c7c7018c62edba87e2ef9f36c3095a621955b`	pdf-javascript-stream	PDF /JS object 111713 at offset 0x3820	2585 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 6 long base64-like blob(s).
`javascript_obj111711_003.js` `5f6186afe506b2d78f98f48135c76c2d99af2bc78676b855c879a0521cad3ea8`	pdf-javascript-stream	PDF /JS object 111711 at offset 0x1B2	16603 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 16 long base64-like blob(s).
`javascript_obj111712_004.js` `7340309fc4212b70cf34a5e70c600f1a0a9063f9fcc0f93bd86bdec6783733ef`	pdf-javascript-stream	PDF /JS object 111712 at offset 0xD89	13572 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 11 long base64-like blob(s).
`javascript_obj111713_005.js` `865c60647e79f5d9bd85ded9ddf8f14b7f405d948bed2207ad4ff2ff7c700e2a`	pdf-javascript-stream	PDF /JS object 111713 at offset 0x3843	2634 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 6 long base64-like blob(s).
`legacy_pdfkit_stage_000.js` `fb267055bbd154bd3be4e2c4a1110e35dbc8540ba9e0d7bbbc6571a847b34e00`	deobfuscated-js	multi-marker percent-array decoded JavaScript at offset 0xD65	1078 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`legacy_pdfkit_stage_001.js` `5954b70ca082158352cca1ad0566f192b13ccdc9723d443b46a8747bc29728a3`	deobfuscated-js	multi-marker percent-array decoded JavaScript at offset 0x3820	174 bytes
`legacy_pdfkit_stage_002.js` `690f0bd00d60cbd31f38a38a4cf6d89b64f38d85cc263b63e65095bbe01b551a`	deobfuscated-js	multi-marker percent-array decoded JavaScript at offset 0x1B2	1253 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`legacy_pdfkit_stage_003.js` `b9e0d6f711f3409363ea4a3e0248512cc65f465d772e670d3242c26f93b2ead5`	deobfuscated-js	multi-marker percent-array combined decoded JavaScript at offset 0xD65	6444 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.