PDF malware analysis — malicious · a13edec167ecef9a

MALICIOUS

PDF

1.31 MB

MD5: 0bbe414aa9f2631da37f9ce6ee1f8e95 SHA-1: 6dcc56d9096c3c757d960e9aa9fe21854e8a9cf2 SHA-256: a13edec167ecef9aa0eae2b38dc11f87d35d148afdeba8b65f0feddf279f160c

126 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command and Shell

The PDF file contains multiple JavaScript streams, one of which (offset 0x4EB) exhibits prototype pollution patterns and uses eval() calls, indicating obfuscated code execution. This script is likely designed to download and execute a secondary payload. The presence of XFA forms and embedded scripts further supports this malicious intent. No specific family could be confidently identified.

Heuristics 8

Prototype-pollution JavaScript pattern high CVE related PDF_JS_PROTOTYPE_POLLUTION

PDF JavaScript mutates object prototypes while also referencing privileged or sensitive PDF APIs. This tracks a modern PDF exploit technique family without assigning an unverified CVE.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xfa/promoted-desc/

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_001_off00000127.js` `7b464e249f91586a383ad4eb0a3511069d529b5964551ddee2766a12903476ff`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x127	2370 bytes
`stream_002_off000004eb.js` `21094abb199a994107be219074ff96f4e71ad0d6059e50205539940a89d507d0`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4EB	890946 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 4 long base64-like blob(s).
`stream_003_off0002f1e4.bin` `b16a77f36a1dbb10b68158d5bc3bc5894c1696984d4fcfb18db002aa5ca6cb65`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2F1E4	5711 bytes
`stream_004_off0002f65f.bin` `cac9c34aeab80f505296f22cac62dc239a5cea1ffae6361d1991c279d415fadb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2F65F	47559 bytes
`stream_005_off00030624.bin` `aed74f4e238703d36f49c1283dddd71286163ad0a8dfb9f3bd16e0d999508b69`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x30624	8079 bytes
`stream_006_off00030d67.bin` `68bfd948fc6de63e3c605a1df613b7ff2c0b9979daeda1c78dd82d3551f0a512`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x30D67	364 bytes
`stream_013_off0007499a.bin` `b2a50460b1fc66b7680230c728241859435e1af538bd15e880282e123198de62`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x7499A	102219 bytes
`stream_014_off00086313.bin` `f13c106e4ee427254e92d68485d1420403c9e874eee0f33787ff10fe62f8018f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x86313	188972 bytes
`stream_015_off000a5f62.bin` `55cb4b903a99e15bba7a1da6ca466776cafcadab161604e20e685e4472952dcf`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xA5F62	196605 bytes
`stream_016_off000c7100.bin` `b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xC7100	367087 bytes
`stream_018_off001187a5.bin` `1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1187A5	352198 bytes
`stream_020_off0014c545.js` `f8721569904600df33f536ddc9f4942717077f9d6c3c4253a8f4de5650fc6531`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x14C545	1367 bytes
`stream_021_off0014c72e.js` `91ea259764c68d27b8981a339c02d8ea92224ae5c0d0cd0a7c8f3d645d599090`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x14C72E	902 bytes
`objstm_0021_00.bin` `b3027169be6d7b3d205244c66e82b15ed2ac9cd7b59e4e0d850a9360850b0073`	pdf-objstm-decoded	PDF /ObjStm 21 0 obj (inflated)	23627 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 long base64-like blob(s).
`font_00_sfnt_off000312b8.bin` `c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x312B8	95975 bytes
`font_01_sfnt_off000415a2.bin` `4f8a962143becce891b0f8d40b5315e54e2a298ba661302850ebd34e48af909a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x415A2	99778 bytes
`font_02_sfnt_off00052862.bin` `b1260c85fef77007b5f19c1c6f3552e1c6ade6c959082cf86dd6971951ed119c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x52862	102071 bytes
`font_03_sfnt_off0006427f.bin` `926d8eb5abd4c74e46a419aaf25a490564d389c7a250d2392b198a342df65b8a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6427F	97320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.