PDF malware analysis — malicious · 8265ec14571a55f2

MALICIOUS

PDF

22.8 KB Created: 2009-05-06 20:45:24 +08:00 Authoring application: DocuCom PDF Core Library

MD5: 98382a0065b99be6bb6218057d02c732 SHA-1: 88bdc77d8228cc6708899ee4658dce97e2a870c5 SHA-256: 8265ec14571a55f26fe93a928ee726e28a4b6e94ffe1e3f68c4856fd5efc21f8

370 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that leverages the CVE-2009-0927 vulnerability (Collab.getIcon). This JavaScript is heavily obfuscated but is identified as a generic exploit stage, indicating its purpose is to download and execute a secondary payload. The critical heuristic firings and ML classifier output strongly support this malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 10

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 15

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0003_000.js` `3a63aa1468610780740c9dc83aeeec5b08cb097e75c7162b2fbf08d5be27c95c`	pdf-javascript-stream	PDF /JS object 3 at offset 0x883	7299 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`javascript_obj0026_001.js` `b194088593d04ae8b00784d7dabf450f47343d7a1f95bc9e53dbaf6b0b9fd395`	pdf-javascript-stream	PDF /JS object 26 at offset 0x20D6	14600 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: unlikely
`stream_011_off000020d6.bin` `5778b19168f8d8dbdbd355afb3c1e63e0fac8185f33340f2b7f1637a3736a976`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x20D6	7299 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_000.js` `7e27c9dd3f52261d7c8018838b81bf9d134d85c09f1c213544554b371747af66`	deobfuscated-js	generic stage recovery split-literal-normalize from JavaScript object 3 at offset 0x883	5781 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_001.js` `1a7ececba8173046470c3d9bcfd7b890e165660c18b89eeb6ddd5263f4f04bdc`	deobfuscated-js	generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x883	20382 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_002.js` `0ab541e86fcc9a62daef5f2e864326253975716f95cd6d9fd049e5642501bff4`	deobfuscated-js	generic stage recovery split-literal-normalize from decompressed stream at 0x20D6 at offset 0x20D6	5781 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_003.js` `5d41a6961f14341c702c65e133d441c8d420b9c7dbb42e1a9f08b42b606dd5c6`	deobfuscated-js	generic stage recovery split-literal-normalize -> split-literal-normalize from JavaScript object 3 at offset 0x883	5778 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_004.js` `ee7394fb02b35ec856df28f2593b5311bb4a174dfa533c756dd1aa5818511382`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from JavaScript object 3 at offset 0x883	5773 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_005.js` `dca7951db8236ec91d1ad86671670c9d66633712bdd5f6b22e21d33fe54cdd31`	deobfuscated-js	generic stage recovery null-collapse -> split-literal-normalize from JavaScript object 26 at offset 0x20D6	5783 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_006.js` `8bef89e41f75eed951f4f7258aadc93cec6817ce233fb8deffbffa26c09a6f69`	deobfuscated-js	generic stage recovery null-collapse -> split-literal-normalize from combined JavaScript objects at offset 0x883	11565 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 8 eval/decoder/string-building token(s).
`generic_stage_recovery_007.js` `fa77ad741bdc187e3b4026cb65fa9091e10cdfedf815ccb778c857989660805e`	deobfuscated-js	generic stage recovery split-literal-normalize -> null-collapse from combined JavaScript objects at offset 0x883	13083 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 8 eval/decoder/string-building token(s).
`generic_stage_recovery_008.js` `64fc39e01ab0cda4e7e3667c120391c58eaf07e5abb14daf4cbd9d3b08d6fa08`	deobfuscated-js	generic stage recovery split-literal-normalize -> split-literal-normalize from combined JavaScript objects at offset 0x883	20379 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_009.js` `594c93157b398510d68869b8542ab63e35d1cd576a78eebd33d3a8bb222be04b`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x883	20374 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_010.js` `d602fa0df2c03a24e11adb75f37c0e349a4df7f021474f366fd556fa90d8c70a`	deobfuscated-js	generic stage recovery split-literal-normalize -> split-literal-normalize from decompressed stream at 0x20D6 at offset 0x20D6	5778 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`generic_stage_recovery_011.js` `9192a684d91d758271113a3619ce60066d1805b1f2cc370879e1b405327904b3`	deobfuscated-js	generic stage recovery split-literal-normalize -> percent-decode from decompressed stream at 0x20D6 at offset 0x20D6	5773 bytes
Detection ClamAV: Pdf.Exploit.Agent-35646 Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.