PDF malware analysis — malicious · 8a268b55c11dbe0e

MALICIOUS

PDF

MD5: b2a2fccd9f8d6864a8f4f9c8081ddbba SHA-1: e45a13b9ae154ff7f67b20c1f65d094181e45497 SHA-256: 8a268b55c11dbe0e111a971b87f56108d144803408192fc5990026fcc05a4faf

118 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic firing for CVE_2007_5659 indicates the exploitation of a known vulnerability in PDF documents. The embedded JavaScript stager, recovered as annotation_subject_callee_hex_stage_000.js, is responsible for decoding and executing further malicious code. This suggests the primary function of the PDF is to serve as a dropper for a secondary payload, leveraging the identified CVE for initial execution.

Heuristics 5

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
Annotation subject callee-key hex JavaScript stager high PDF_ANNOT_SUBJECT_CALLEE_HEX_STAGER

PDF JavaScript uses syncAnnotScan()/getAnnots() to read an indirect annotation /Subject stream, percent-decodes it through marker replacement, then uses a callee.toString()-derived key to decode and eval the final exploit stage.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `c2b551523ac4433bcfaa8b414788d2e5d745fd98f3c7cb7505a268726ccfe7c5`	pdf-javascript-stream	PDF /JS object 9 at offset 0x405F	831 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`annotation_subject_callee_hex_stage_000.js` `b59c5dd0e6628433766938ae515df33ac6cf8503dc42bc6d9ba45962df587961`	deobfuscated-js	annotation-subject callee-key decoded JavaScript at offset 0x8F	5153 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`legacy_pdfkit_stage_000.js` `7f6d4c761a6a609b666b863f55060e9b5c31092ae8c3147178f795e55fecaddf`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x1AE0	11497 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`deobfuscated.js` `8c99593012d81a69e3c4e9c3dc55bb7d5d8eee232474db24598850af53013d85`	deobfuscated-js	PDF JavaScript deobfuscation pass	111976 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.