PDF malware analysis — malicious · a0e2713804a64da6

MALICIOUS

PDF

8.7 KB Created: 2012-01-31 10:56:04 Authoring application: eraere gaggal

MD5: f51ca98e48e5d06dab8a2a1ea1e63aae SHA-1: 79023d18aa5483b0369e58921b8649bf33cfff14 SHA-256: a0e2713804a64da6c1b6926db30938b371bed5807605e71d2f9e03556ea8b7e0

98 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The sample is a PDF document that exploits CVE-2010-0188, a vulnerability in Adobe Reader related to LibTIFF XFA image processing. This exploit likely leads to the execution of a secondary payload, as indicated by the 'PDF_EMBEDDED_SCRIPT_PAYLOAD' heuristic and the presence of an embedded file object. The embedded file, 'embedded_file_obj0019.bin', is substantial and likely contains the malicious code.

Heuristics 5

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains the CVE-2010-0188 exploit template: XFA JavaScript heap-spray setup, a generated TIFF image payload, and assignment of that TIFF data to an XFA image field rawValue to trigger Adobe Reader's LibTIFF parser.
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0014.bin` `69a4c6fdf7817eb433ee513b974fa8b9b66ac1a10882a762868fa1cdbb683350`	pdf-embedded-file	PDF EmbeddedFile object 14 at offset 0x90A	149 bytes
`embedded_file_obj0006.bin` `24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0`	pdf-embedded-file	PDF EmbeddedFile object 6 at offset 0x9ED	228 bytes
`embedded_file_obj0003.bin` `c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460`	pdf-embedded-file	PDF EmbeddedFile object 3 at offset 0xADD	199 bytes
`embedded_file_obj0007.bin` `5ecaa9ef6eb2eb712da8e50ec12801b53ecfd60dcfd8b6cbbcbf999762d5c36c`	pdf-embedded-file	PDF EmbeddedFile object 7 at offset 0xBCE	195 bytes
`embedded_file_obj0002.bin` `e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876`	pdf-embedded-file	PDF EmbeddedFile object 2 at offset 0xCB5	77 bytes
`embedded_file_obj0016.bin` `92a3ce61d783e15932b5de127ce45a9b4c2f98f4da2453f65241573c1dda808a`	pdf-embedded-file	PDF EmbeddedFile object 16 at offset 0xD5C	56 bytes
`embedded_file_obj0019.bin` `a33201128e8674d1023d83152b86e47f418bbf0536915ed689f4fe30b6748532`	pdf-embedded-file	PDF EmbeddedFile object 19 at offset 0x1128	69839 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.