Malicious PDF — malware analysis report

Static analysis result for SHA-256 838f7e09fa2c67ae…

MALICIOUS

PDF

24.1 KB
MD5: 0fafb2ab5453fe13c4a316da018b0202 SHA-1: 376b4ce15b33d3edc74561576bd9e95d4ea1568d SHA-256: 838f7e09fa2c67ae930f5c8d1980db5d599be2d83fad12e6ae321f9392f76a40
128 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a PDF file that contains an XFA form, which is a known vector for exploiting Adobe Reader vulnerabilities. Static analysis identified a critical heuristic match for CVE-2010-0188, indicating exploitation of a LibTIFF vulnerability within XFA. The embedded URL, while not directly malicious, is part of the XFA template structure. The document body contains obfuscated JavaScript, likely part of the exploit chain, but its exact function could not be determined without dynamic analysis.

Heuristics 4

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains the CVE-2010-0188 exploit template: XFA JavaScript heap-spray setup, a generated TIFF image payload, and assignment of that TIFF data to an XFA image field rawValue to trigger Adobe Reader's LibTIFF parser.
  • ClamAV: Pdf.Exploit.Agent-36821 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36821
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.xfa.org/schema/xfa-template/2.5/

Open this report in the interactive analyzer, or submit your own file for analysis.