Malicious PDF — malware analysis report

Static analysis result for SHA-256 a34952d9a77720a5…

MALICIOUS

PDF

2.7 KB Created: 2008-08-06 01:42:27
MD5: feb514eaab8627b37491874e66cff211 SHA-1: e76eecf282fb16d44f26eb43ce1b6f8a2b3c2ade SHA-256: a34952d9a77720a5972a5449494742ede51614a87f060143dccd4432032a7ae9
316 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains embedded JavaScript and is configured with an OpenAction trigger, indicating an attempt to automatically execute code upon opening. The critical heuristic firing for CVE-2007-5659 (Collab.collectEmailInfo) strongly suggests exploitation of this known vulnerability. The embedded JavaScript stream, identified as 'javascript_obj0013_001.js', likely contains obfuscated code designed to download and execute a secondary payload, as indicated by the ClamAV detection on both the main file and the extracted artifact. The presence of JavaScript actions and unescape calls further supports this attack vector.

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • ClamAV: Win.Trojan.Agent-34667 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-34667
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • OpenAction trigger high PDF_OPENACTION
    PDF has an /OpenAction — code runs automatically when opened
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js
ef316ea976c7810f46536510150a8f60f85a20feb4b2d22bd69115aec2defc38		 pdf-javascript-stream PDF /JS object 13 at offset 0x36C 2661 bytes
Detection
ClamAV: Win.Trojan.Agent-34667
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.