Malicious PDF — malware analysis report

Static analysis result for SHA-256 83f0edcf4c9890e1…

MALICIOUS

PDF

93.1 KB
MD5: 2b8a0d4eb9fba18c0c5684c23d67766e SHA-1: 1b42add6cfd87fe2a24f3901123e0624fbdc5a67 SHA-256: 83f0edcf4c9890e1f25cd18e6476505bd77e8f12e8c4d15728fdaff9d12f8190
178 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript and exploits the CVE-2009-4324 vulnerability via the media.newPlayer object. A secondary embedded PDF was also detected with similar suspicious findings, including JavaScript. The unescape() function was used, indicating potential obfuscation. The primary goal appears to be the execution of malicious code, likely leading to a further stage of infection.

Heuristics 7

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0057_000.js
9d4167ae4f7c5d2f2ee88553518d38f9dcd31623ff941c116f92c46ba7bb8572		 pdf-javascript-stream PDF /JS object 57 at offset 0x551F 46022 bytes
stream_005_off00000b74.bin
e4217c167299ac63f64b8b7e903cc0196f0828693d273431b8b793a12ed0fed3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB74 1000 bytes
stream_014_off00005555.js
4389c8d7cc81cec8815aa2ea9c9e32c15c795ddcef36c7e70ab3d6fb4a41e8b5		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5555 2186 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
objstm_0053_00.bin
f9797d0fa28384c30d8bf1da89163104ce539753e417fa1f9c5fd135d1eceb39		 pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 50 bytes
polyglot_child_pdf_off00010897.pdf
6f803eea1a135be64c263d822ef2bdb0bb6e45baab5ad5a7d82ce8106c61e1f2		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x10897 27598 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.