Malicious PDF — malware analysis report

Static analysis result for SHA-256 8382d4ee03010a51…

MALICIOUS

PDF

1.8 KB
MD5: f58fc4fbb6960f795909470f9bbad86a SHA-1: d28f57187a082e21b432f3335e63415bf3ef23e4 SHA-256: 8382d4ee03010a515547245c8e74c5b5037d71f763bae9e9f8282f1d90c389c5
194 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF sample contains JavaScript that leverages the CVE-2008-2992 vulnerability via the util.printf function. The JavaScript appears to be obfuscated but reconstructs a URL, 'http://192.168.1.100/download/file.php?p=5o-e2-992-99R', which is likely used to download and execute a second-stage payload. The use of ASCIIHexDecode and ASCII85Decode filters further indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Pdf.Exploit.Agent-36183 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36183
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
f86b1e5220183f7c7e3ea8cddca0c8beed42f4aca8952f8c95b07b9823f2ed6e		 pdf-javascript-stream PDF /JS object 6 at offset 0x138 1345 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.