MALICIOUS
660
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.007 JavaScript
The PDF document contains embedded Flash content that exploits multiple known vulnerabilities in Adobe Flash Player and Reader. The heuristics indicate a heap spray and a multi-stage JavaScript exploit loader, suggesting the primary goal is to execute arbitrary code. The embedded Flash content and JavaScript are designed to bypass security measures and deliver a malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.6458
Heuristics 16
-
Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIAPDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
-
Adobe Flash/authplay SWF exploit in PDF — CVE-2009-1862 critical CVE likely CVE_2009_1862_FLASH_RICHMEDIAPDF combines RichMedia Flash activation, an embedded SWF, and PDF-side shellcode heap-spray staging. This matches the 2009 authplay.dll Flash-in-PDF exploit delivery shape even when the SWF bytecode does not expose stable printable Run_Sploit markers.
-
Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIAPDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
-
CVE-2010-1297 — Adobe Flash/Reader authplay heap-spray (Flash-in-PDF) critical CVE likely CVE_2010_1297PDF embeds a Flash (SWF) object via RichMedia and its JavaScript heap-sprays to groom memory for the embedded Flash exploit. This is the CVE-2010-1297 (authplay.dll) Flash-in-PDF memory-corruption shape; the spray is recovered after de-obfuscating space-padded %u, fromCharCode and \u builders that evade the raw heap-spray rules.
-
Flash ActionScript-3 exploit loader in PDF critical PDF_FLASH_AS3_EXPLOIT_LOADERAn embedded Flash (SWF) object's ActionScript-3 bytecode contains exploit-loader primitives: decompressing an inner SWF into a ByteArray and executing it via LoaderContext.allowLoadBytesCodeExecution, and/or Vector heap/JIT spray groomers. Benign Flash content does not load and execute code from raw bytes — this is a staged Flash exploit delivered through the document.
-
JavaScript action low 3 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
Obfuscated multi-stage PDF JavaScript heap-spray exploit critical PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAYPDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var st = unescape("\x25\x75c8d9\x25\x7574d9\x25\x75f424\x25\x75eeba\x25\x75e0ec\x25\x7529dc\x25\x755fc9\x25\x7537b1\x25\x755731\x25\x758314\x25\x751001\x25\x752402\x25\x754207\x25\x75dce0\x25\x7555ee\x25\x75dce4\x25\x75ecee\x25\x75b8bf\x25\x75dc4f\x25\x75dce0\x25\x7567ee\x25\x75d0a0\x25\x759c65\x25\x7571fc\x25\x758465\x25\x758de8\x25\x759965\x25\x7557dc\x25\x75c29a\x25\x75df98\x25\x75ba1b\x25\x75aa6b\x25\x75efce\x25\x75ef15\x25\x75a527\x25\x7571a1\x25\x7529ed\x25\x7507d3\x25\x7552e1\x25\x75e4f0\ … -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
JPXDecode + active content — JPEG2000 CVE-family indicator high PDF_JPX_CVE_2018_4990_RELATEDPDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
-
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGEA valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
-
RichMedia (Flash) high PDF_RICHMEDIAPDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off00000372.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x372 | 5080 bytes |
SHA-256: 1a81c36b5f85fc62664f891208ba45856fa01f5c0a77c64e2ce94790ad5a16c4 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 3 eval/decoder/string-building token(s).
|
|||
objstm_0015_00.bin |
pdf-objstm-decoded | PDF /ObjStm 15 0 obj (inflated) | 912 bytes |
SHA-256: cbd11d2ce487f41cb2e696adc35306d2f3d38b7de6eab25b0e0d07f05d693f12 |
|||
objstm_0106_00.bin |
pdf-objstm-decoded | PDF /ObjStm 106 0 obj (inflated) | 333 bytes |
SHA-256: ed50150bcde1f49052b4b14a24bb3b09e2d9afc877eb1497c4764062853371b5 |
|||
polyglot_child_pdf_off00015793.pdf |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0x15793 | 333533 bytes |
SHA-256: 4b0e5a330aebd92e39888b8e3023a9175a0a97d8969b949596c8534725f4ae8b |
|||
polyglot_child_pdf_off00065683.pdf |
polyglot-child-pdf | Secondary PDF body inside pdf container at offset 0x65683 | 6125 bytes |
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.