Malicious PDF — malware analysis report

Static analysis result for SHA-256 977039d6ca38c5c0…

MALICIOUS

PDF

287.5 KB Created: 2009-09-17 09:09:59 +08:00 Authoring application: Acrobat Distiller 7.0 (Windows)
MD5: b83533c617316f4d2ce3d1b88d63dcb7 SHA-1: 27e99a0940175f7c90cdd0d917ef4223b9b5591a SHA-256: 977039d6ca38c5c0920c1ddaddd686ed230ac74c9c06c1049e872a44c4ea7587
78 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded JavaScript that leverages the CVE-2009-0927 vulnerability (Collab.getIcon). The JavaScript is obfuscated but appears to be designed to download and execute a secondary payload. The presence of JavaScript actions and embedded JS streams, along with the specific CVE firing, strongly indicates an exploit attempt. No specific family could be identified due to the generic nature of the exploit.

Heuristics 5

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdfx/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0017_000.js
29f3737c2668ec56e4ea94a51a7514cde4d82b0ae9dfed8f04100f14cb6db578		 pdf-javascript-stream PDF /JS object 17 at offset 0x4DA 2916 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
js_property_alias_stage_000.js
25e1c8d348f30abc1ec2d1b24cedf663b82aa6e029879ffe8d1c49e8c86125b9		 deobfuscated-js JavaScript property alias normalized stage at offset 0x4DA 2576 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.