Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d751a1fcf301648…

MALICIOUS

PDF

170.8 KB Created: 2008-03-20 15:51:33 +08:00 Authoring application: Acrobat 编辑器 8.0 (via Adobe Acrobat 8.1.0)
MD5: 1afe6df27e7ec5b198c96732adb8eeb6 SHA-1: 9e8bdd84738208acd4a5842c008cd1bbd9e4f77e SHA-256: 8d751a1fcf301648af9a3f7413b682e27f7104a1236f310e735e5bfe57a9b417
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The file is a PDF that contains embedded JavaScript, which is a common technique for exploiting vulnerabilities. Specifically, the CVE-2007-5659 heuristic indicates the use of a known exploit targeting Adobe Reader. The embedded JavaScript stream, along with the ML classifier and ClamAV detection, strongly suggests malicious intent. The primary function appears to be the execution of arbitrary code via the exploit, likely leading to the download and execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 9

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • ClamAV: Win.Trojan.Dropper-82 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Dropper-82
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PermissionError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0032_000.js
58b654326c3fbb53baf38fc48e979ee8d32a824d8b6b6cf91f0658dfdb45ebf0		 pdf-javascript-stream PDF /JS object 32 at offset 0x7DD 4622 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 16 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.