Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c133f1c4201fc6f…

MALICIOUS

PDF

376.1 KB Created: 2009-07-08 10:53:46 +08:00 Authoring application: Acrobat Distiller 7.0 (Windows)
MD5: 6b595c686f782af10915b113cfc9389f SHA-1: c4e7212c366b2dc9dc3377d97f75be9c999272ff SHA-256: 7c133f1c4201fc6f654457723a30de3fa207c5701ef8f3497693d114d8525842
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains embedded JavaScript that exploits the CVE-2009-4324 vulnerability. The heuristic firings indicate the presence of JavaScript actions and embedded JS streams, specifically leveraging the 'media.newPlayer' property alias. This suggests the document is designed to download and execute a malicious payload upon opening in a vulnerable PDF reader.

Heuristics 4

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdfx/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0017_000.js
e09c11a234f64adaffab57715b8092ca8ba50bababda482d288dbb68b8e2db9b		 pdf-javascript-stream PDF /JS object 17 at offset 0x4DA 3452 bytes
js_property_alias_stage_000.js
dd112bcd2655c65dd6910fb28dff51e4621c079e5f6f80d579991898267abe5c		 deobfuscated-js JavaScript hex-escape property alias normalized stage at offset 0x4DA 3236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.