Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dca937e7b390c34…

MALICIOUS

PDF

125.4 KB Created: 2007-01-23 22:50:24 +02:00 Authoring application: PScript5.dll Version 5.2.2 (via GNU Ghostscript 7.05) First seen: 2026-05-11
MD5: 95fc06623b0c1caa729e50778136ef6e SHA-1: cd4db0d089b4a55887dca24f5ce55ffa3f58302e SHA-256: 7dca937e7b390c34eef8d655f7c331e11ae431f8cad32b85fe434c2dc9e90331
544 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes the `exportDataObject` function to launch `cmd.exe`. This command then attempts to execute an embedded Windows executable, disguised as 'hi.pdf', which was detected by ClamAV as Win.Trojan.Rozena. The exploit targets CVE-2010-1240, allowing for command execution and payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 13

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\hi.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.see-security.com In PDF document text
    • http://www.hackingdefined.com/exploits/globalscape_ftp_30_EIP.pyIn PDF document text
    • http://www.hackingdefined.com/exploits/globalscape_ftp_30_SEH.pyIn PDF document text
    • http://www.hackingdefined.com/exploits/globalscape_ftp_30.pmIn PDF document text
    • http://www.whitehat.co.il/background.jpgIn PDF document text
    • http://www.securityforest.com/wiki/index.php/Exploit:_Stack_Overflows_-_Exploiting_SEH_on_win32In PDF document text
    • http://class101.org/In PDF document text
    • http://metasploit.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
hi.pdf pdf-embedded-file PDF EmbeddedFile object 161 at offset 0x1A47F 37888 bytes
SHA-256: b4d7b497e1310d76be242b3fffc948a1ccfcf398b9722f69dda2f0044df99e08
Detection
ClamAV: Win.Trojan.Rozena-131
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=hi.pdf; kind=pdf-embedded-file Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_GETPROCADDRESS, SC_STR_LOADLIBRARY Static shellcode analysis recovered API/import strings: GetProcAddress, ExitProcess, LoadLibraryA, VirtualAlloc
javascript_obj0162_000.js pdf-javascript-stream PDF /JS object 162 at offset 0x1F117 51 bytes
SHA-256: de4c80896e147f37ea5cec116d371bbcbd998f54e3e8d0c3b46b03088db863e5
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "hi", nLaunch: 0 });
font_00_cff_off000037f0.bin pdf-font-stream PDF embedded font (cff) at offset 0x37F0 3647 bytes
SHA-256: d26c2bea1996db830f63fa11233495babe5c3e3a01f670e24713852ef6a9d16f
font_01_sfnt_off000044b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44B9 22020 bytes
SHA-256: c00f0ff09f07e14de314e2af5124a0afa2485c2884762b0caf1e7c859b9a55fe
font_02_cff_off00007232.bin pdf-font-stream PDF embedded font (cff) at offset 0x7232 8072 bytes
SHA-256: e7b253dbf3c26d6ce8c69f06c6027e7ea571c2b408e2320b93fd1814e10d7fdc
font_03_cff_off00009042.bin pdf-font-stream PDF embedded font (cff) at offset 0x9042 6877 bytes
SHA-256: 218112f916ce98c6cd5360f82b332f77ce062dd4ed1912b5ff4e47bc00c9daaf
font_04_cff_off0000a854.bin pdf-font-stream PDF embedded font (cff) at offset 0xA854 623 bytes
SHA-256: b20f44ce900f5cdf5b8dace771d76f6af30244acba213490887b4b84af433af8
font_05_sfnt_off0000ab1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB1A 5516 bytes
SHA-256: 03599ff1dcf9b89d2c74e32dae6f9bec95317068a16b6b910c5cacae158fbf53
font_06_cff_off0000d03c.bin pdf-font-stream PDF embedded font (cff) at offset 0xD03C 8633 bytes
SHA-256: abd2f4012e189aa50839dff69802316cc1344988951e2e1c6666e6b9b2e8b161
font_07_cff_off0000e9b3.bin pdf-font-stream PDF embedded font (cff) at offset 0xE9B3 9070 bytes
SHA-256: 2564f3cf7927e71a2cb1fcc327fa612346b98bc6f567ab942ca74f34cc4c215d
font_08_cff_off00017fa1.bin pdf-font-stream PDF embedded font (cff) at offset 0x17FA1 638 bytes
SHA-256: 8bf6fbff44b32512041e09b2e4bfa73f4d818b419d88fe68ce66b9d4318ce82f

Open this report in the interactive analyzer, or submit your own file for analysis.