PDF malware analysis — malicious · 8a5674c050ccd398

MALICIOUS

PDF

7.2 KB Created: 2011-03-11 10:45:27 Authoring application: zap off

MD5: ec8ab2553aa390aa6632b1b5a9f7f3eb SHA-1: 832fe0d70eb461f4b8eff96d7627c5d08b8efe87 SHA-256: 8a5674c050ccd3981e01330042f5c5bc62f7cd2250ef2cf2fb1bca58437ae3c6

140 Risk Score

Malware Insights

This PDF document is malicious due to the critical CVE-2010-0188 heuristic firing, indicating an exploit for Adobe Reader's LibTIFF component. The PDF contains embedded files and XFA forms, with one decoded stream showing evidence of an unescape() call and a script payload. This suggests the document is designed to deliver and execute a secondary payload via the exploit.

Heuristics 6

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains the CVE-2010-0188 exploit template: XFA JavaScript heap-spray setup, a generated TIFF image payload, and assignment of that TIFF data to an XFA image field rawValue to trigger Adobe Reader's LibTIFF parser.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0004.bin` `d81baa73e490e4cb879e13927cacd1dd1be37524a37eac51603e15117c578777`	pdf-embedded-file	PDF EmbeddedFile object 4 at offset 0x7DF	84 bytes
`embedded_file_obj0011.bin` `24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0`	pdf-embedded-file	PDF EmbeddedFile object 11 at offset 0x891	228 bytes
`embedded_file_obj0019.bin` `c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460`	pdf-embedded-file	PDF EmbeddedFile object 19 at offset 0x982	199 bytes
`embedded_file_obj0006.bin` `3028a83799fbeb61ac2800d74d4856ea4a1881d183b1a7585c95ad2458fdecc2`	pdf-embedded-file	PDF EmbeddedFile object 6 at offset 0xA73	154 bytes
`embedded_file_obj0013.bin` `e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876`	pdf-embedded-file	PDF EmbeddedFile object 13 at offset 0xB45	77 bytes
`embedded_file_obj0008.bin` `92a3ce61d783e15932b5de127ce45a9b4c2f98f4da2453f65241573c1dda808a`	pdf-embedded-file	PDF EmbeddedFile object 8 at offset 0xBEB	56 bytes
`embedded_file_obj0010.bin` `93362532ad25bbfd0bed552139b139c5fe9b93e0d13734557f6eb8cccf9de902`	pdf-embedded-file	PDF EmbeddedFile object 10 at offset 0xF68	8863 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.