PDF malware analysis — malicious · 8cc4c3ab1ee55ef5

MALICIOUS

PDF

23.0 KB

MD5: 3c4a73450529054eaa1b7fc3ede72f6b SHA-1: 6dcf5bfe2862b249f2e1b0162d2843485a6b00bf SHA-256: 8cc4c3ab1ee55ef58efe13433910596cf2012c4b385580d2bcfd8678675a17a6

118 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF sample contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, PDF_EVAL, and a critical CVE_2008_2992 alert. The JavaScript utilizes eval() and unescape() functions, common in exploit kits, to decode and execute malicious code. The presence of 'util.printf' and the CVE-2008-2992 alert strongly suggest exploitation of this specific vulnerability. The obfuscated JavaScript is designed to download and execute a second-stage payload, as evidenced by the embedded JS streams and deobfuscated JS files.

Heuristics 5

util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj111711_000.js` `3c056fd140de653dd167fc5025a9d12fec63fc2c40820d5302489d402247a58f`	pdf-javascript-stream	PDF /JS object 111711 at offset 0x18E	3773 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).
`javascript_obj111712_001.js` `f1bc94f4f004eb6b0f3c812800434af4a8dd36bc3204245391e7b2b1075b397b`	pdf-javascript-stream	PDF /JS object 111712 at offset 0x1081	14709 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).
`javascript_obj111713_002.js` `538ab93d10c8e669e424ede3503b2de45d79c3364fdb4641adaf97533a3d7b54`	pdf-javascript-stream	PDF /JS object 111713 at offset 0x4A2C	4491 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).
`legacy_pdfkit_stage_000.js` `b4424d7abfe374f9b989a8b63b99c483406b25f93adc8dd144d2995004c81b2b`	deobfuscated-js	multi-marker percent-array decoded JavaScript at offset 0x1081	1422 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
`legacy_pdfkit_stage_001.js` `df2e8f38acbcede11c3621c62802a425613ee3b105933e1debbf6452a55bb89f`	deobfuscated-js	multi-marker percent-array decoded JavaScript at offset 0x4A2C	384 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`legacy_pdfkit_stage_002.js` `ea94cd1c630e7441a2f1da6530132a6445e8a2a36b5ff75d87f2e1e3b4c53d45`	deobfuscated-js	multi-marker percent-array combined decoded JavaScript at offset 0x1081	1807 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.