PDF malware analysis — malicious · 9d9f6ca17c8838b9

MALICIOUS

PDF

124.3 KB

MD5: 5d7fe28899406bf57bcc08351877e5cc SHA-1: c9438f62ef0b3f057dc31dbf89465f2a7fb27f7e SHA-256: 9d9f6ca17c8838b9c74ca0b9e8959fe4344f0e2aacd0a4200eea86218474fd0e

178 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The PDF file contains embedded JavaScript and triggers the CVE-2009-0927 vulnerability via the Collab.getIcon method. This indicates an attempt to exploit the PDF reader to execute malicious code. The embedded JavaScript streams are large and show signs of obfuscation, suggesting they are intended to download and execute a second-stage payload.

Heuristics 7

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution.
ClamAV: Pdf.Exploit.CVE_2009_0927-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.CVE_2009_0927-1
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://windowstips.wordpress.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `fb7652d8669787807220c67911a1bf1c3f1497fb723be13df72e7fef8770e003`	pdf-javascript-stream	PDF /JS object 7 at offset 0x28F	126312 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`javascript_obj0007_001.js` `721181ddeab84df49b8cafc6b113b5fc7aff7f8333cd2f937e33bee989ab6b53`	pdf-javascript-stream	PDF /JS object 7 at offset 0x28F	124446 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.