Malicious PDF — malware analysis report

Heuristics 7

• TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
  PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
• PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
  PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://starlightstonesandconstructions.com.ng/css/ade/adobeCom/index.php In PDF document text

  • https://littleplanetpreschool.com/web/js/dp17/index.htmlPDF link annotation
  • https://www.urjafabrics.com/js/dropbox17/dropbox17/index.htmlIn PDF document text
  • https://ubglobal.sg/assets/js/dropbox17/dropbox17/index.htmlIn PDF document text
  • https://pecocuwi.com/wp-includes/js/dropbox17/dropbox17/index.htmlIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouReferenced by PDF JavaScript
  • http://www.microsoft.com/typography/fonts/default.aspxReferenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0Referenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
  • http://www.microsoft.com/typographyReferenced by PDF JavaScript
  • http://www.microsoft.com/typography/ctfontshttpReferenced by PDF JavaScript

Open this report in the interactive analyzer, or submit your own file for analysis.