MALICIOUS
356
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF file contains embedded JavaScript that exploits multiple known vulnerabilities including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are designed to execute arbitrary code. An extracted JavaScript file, 'numeric_charcode_stage_000.js', was detected by ClamAV as 'Js.Exploit.Shellcode-18', indicating it likely contains shellcode for further exploitation. The presence of multiple critical heuristic firings and the nature of the extracted artifact strongly suggest a malicious intent to download and execute a secondary payload.
Heuristics 8
-
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
-
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
-
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
-
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGEA valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0014_000.js4c451b5b613ddeee7409103c2f50f55054ecffacb9183d66020a24057fcc23af |
pdf-javascript-stream | PDF /JS object 14 at offset 0x398 | 15877 bytes |
numeric_charcode_stage_000.js602b527c194ccb97d5a9dc771ee0ad87f4736c59f24da0e89711f1df702d0550 |
deobfuscated-js | numeric char-code string decoded JavaScript at offset 0x3E5 | 4758 bytes |
|
Detection
ClamAV:
Js.Exploit.Shellcode-18
Obfuscation or payload:
likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
polyglot_child_pdf_off00000d89.pdf79c13019396e8e9c295f776d4cdf060d4058cc5f14e14ddc2c13c1ee86ec8d60 |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0xD89 | 2044535 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.