Malicious PDF — malware analysis report

Static analysis result for SHA-256 903a43a840579fa2…

MALICIOUS

PDF

144.8 KB Created: 2011-01-26 +08:00 Authoring application: 376377000P000D000F000C000r000e000a000t000o000r000 000V000e000r000s000i000o000n000 0000000.0009000.0003 (via AFPL Ghostscript 8.54) First seen: 2026-05-09
MD5: d649c0882e6df38a9728c4f5d96a41bb SHA-1: 01c0590b150d177ece85dc0a9fec7ee59bc98944 SHA-256: 903a43a840579fa247458e561dda5212f198475f9e6da548623dbc5ae3d0aba6
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by an ML classifier as malicious. It contains an embedded file and utilizes XFA forms, which are common techniques for delivering secondary payloads. The presence of an embedded file, named 'embedded_file_obj0077.bin', is a high-priority indicator.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8115

Heuristics 6

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0077.bin pdf-embedded-file PDF EmbeddedFile object 77 at offset 0x68A1 270174 bytes
SHA-256: 34fc422733a5b06b5f5a34dbd77f777c5c3ecb4b7f3c5795253327e9ad28f8c4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
3891 of 4492 identifiers look randomly generated (e.g. 'PT09JdA8HT09PT09PT09PT09PT09PT09PT09wsLC'); 11 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0x6DC6 201328 bytes
SHA-256: 3ec0f298642fddc2712d43f98dff53ee2d9184f4a18a7711a6af9bf9e5885267
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_EGG_HUNTER
font_00_sfnt_off00002000.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2000 16244 bytes
SHA-256: cb2d6203dc1a8a2f6b8ed4ef069a95f5ae720860b5e2cfe4a50516b2e696aa2c
font_01_sfnt_off000038b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38B2 20144 bytes
SHA-256: 1d645b310703d6e11c21104d5b7a34701c06dd11aac3ee8261da3b52123da32b

Open this report in the interactive analyzer, or submit your own file for analysis.