PDF malware analysis — malicious · 7e4f4abbb9daf537

MALICIOUS

PDF

141.7 KB

MD5: 6050254535446e1293cdb961b2040cee SHA-1: 270bafcd934c2ffcb6bea55d8859fc156e003821 SHA-256: 7e4f4abbb9daf537b78908fa4869501cfd5365fe6d036f374b3fbb4a611093d0

154 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript and a Flash object (5.swf), and triggers the critical CVE-2010-2883 exploit for Adobe Reader. The embedded JavaScript, particularly 'javascript_obj0029_000.js', is likely responsible for downloading and executing a second-stage payload. The presence of multiple JavaScript streams and a Flash object indicates a multi-stage attack designed to compromise the user's system.

Heuristics 8

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`5.swf` `f9202a5cd9007c62a212a33809815fddd498c78f8ea667415a9cacbc7aed313c`	pdf-embedded-file	PDF EmbeddedFile object 50 at offset 0x3AF3	2376 bytes
`javascript_obj0029_000.js` `f7f3ed21b7f35ecc19d86bbb10582d1dc121fd8b14199ca02b05334532abb2c9`	pdf-javascript-stream	PDF /JS object 29 at offset 0x22145	19428 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`javascript_obj0038_001.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 38 at offset 0x19E8	1242 bytes
`javascript_obj0039_002.js` `d09a588b22eec2c7828c33f700a6cb6f74ac83f5d53d6ca286bc44cce07b1907`	pdf-javascript-stream	PDF /JS object 39 at offset 0x1FB9	3781 bytes
`javascript_obj0056_003.js` `fd7d21cf68514556b0343a05f24c2ad1824764617801ef6fe16cc43b30be96d4`	pdf-javascript-stream	PDF /JS object 56 at offset 0x2E8A	1064 bytes
`stream_004_off000009f6.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x9F6	434 bytes
`font_00_sfnt_off00000fb8.bin` `fc85f44193ccd402987935418c4f5fdf6802c96450b789e7fce04f9791933021`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB8	7965 bytes
`font_01_sfnt_off00001769.bin` `1e827515a464087cdace63e3578c118b45a657ed40cdbb9de7eead35c9b593ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1769	7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.