Malicious PDF — malware analysis report

Static analysis result for SHA-256 80d3e09e9eaa5121…

MALICIOUS

PDF

954.4 KB Created: 2010-12-15 14:47:20 -07:00 Authoring application: Adobe Illustrator 14.0 (via Adobe PDF library 9.00)
MD5: ae9e1b9493e98c8be6d67e7b37163c83 SHA-1: 40d92361fd1279460758c025167885300685349f SHA-256: 80d3e09e9eaa5121239a2665b7ace66c570d7eb2d2802281f0d700be426971a1
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes eval() and String.fromCharCode(), indicating an attempt to execute malicious code. The presence of PDF JavaScript exploit cluster heuristics and a U3D CVE-related indicator further supports this. The embedded JavaScript, while heavily truncated, appears to be related to interactive content, but the exploit indicators suggest it's being leveraged for malicious purposes, likely to download and execute a secondary payload. The URLs found in the document are not definitively malicious but are included as potential indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9265

Heuristics 12

  • U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED
    PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.kaon.com/aboutPDF
    • http://www.strata.com/rd/live3dmenu.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/illustrator/1.0/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#
    • http://ns.adobe.com/xap/1.0/sType/Font#
    • http://ns.adobe.com/xap/1.0/g/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0043_018.js
5b62bc76e7405dde92d8e3f12a674ac7c12f99f04bf60a2e257dc06a895537cd		 pdf-javascript-stream PDF /JS object 43 at offset 0x2EE44 39853 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 15 eval/decoder/string-building token(s).
stream_042_off00040de2.bin
58d54ae4ab62c233448ab6b2a508140bdb39da27163ea2f1ceebc80d73c9bac8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x40DE2 727180 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.82, consistent with packed or encrypted content.
stream_043_off000e72ff.js
9b476f2ad651e272ef7a3af054ad4483225b897248b6261371918ad0c8d0c43a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE72FF 105559 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
font_00_sfnt_off0000ce25.bin
5b33ab8f8cf4c4be2f928f342dce7db24d2e1f84c921e01496c68fa59610026c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE25 17401 bytes
font_01_sfnt_off0000fb13.bin
db8fd242607f53018543fd892c7a414069ddb4820fbb15cfaea9f9820ea87718		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB13 13334 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.