PDF malware analysis — malicious · a35fed06f3a7e4e6

MALICIOUS

PDF

659.8 KB

MD5: afad7f146ed1d92d06f88ec483708d30 SHA-1: eab24be693cc5b3150f2ecbf94d501ff4b82bf36 SHA-256: a35fed06f3a7e4e61b8432b74514e7c62ac238988dee51ef2099b61d816d45ef

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains embedded JavaScript, as indicated by the CVE-2007-5659 heuristic which specifically mentions JavaScript execution via the Collab.collectEmailInfo function. The presence of U3D content and the ClamAV detection further support its malicious nature. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, though the exact mechanism is not fully detailed in the provided heuristics.

Heuristics 4

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED

PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
ClamAV: Pdf.Dropper.Agent-7289071-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7289071-0
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 20

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`legacy_pdfkit_stage_000.js` `bd3f7cca0a7a96075893165df58ddfbaf5b77485e7579a5a51beb88b7915246d`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x900F1	13024 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`legacy_pdfkit_stage_001.js` `4f39c03cbf9838cc4f2560d387019df27f4b9a84a8d50633f3158a912b5fde13`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x900F1	5403 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`icc_00_off00016f11.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x16F11	3144 bytes
`font_00_cff_off0000eb57.bin` `38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2`	pdf-font-stream	PDF embedded font (cff) at offset 0xEB57	357 bytes
`font_01_cff_off0000f000.bin` `2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca`	pdf-font-stream	PDF embedded font (cff) at offset 0xF000	499 bytes
`font_02_cff_off0000f52d.bin` `755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2`	pdf-font-stream	PDF embedded font (cff) at offset 0xF52D	2550 bytes
`font_03_cff_off0001027b.bin` `eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c`	pdf-font-stream	PDF embedded font (cff) at offset 0x1027B	3369 bytes
`font_04_cff_off00011224.bin` `ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d`	pdf-font-stream	PDF embedded font (cff) at offset 0x11224	2951 bytes
`font_05_cff_off00012059.bin` `650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7`	pdf-font-stream	PDF embedded font (cff) at offset 0x12059	5979 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.40, consistent with packed or encrypted content.
`font_06_cff_off000138d9.bin` `91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a`	pdf-font-stream	PDF embedded font (cff) at offset 0x138D9	1949 bytes
`font_07_cff_off000144ec.bin` `cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751`	pdf-font-stream	PDF embedded font (cff) at offset 0x144EC	6612 bytes
`font_08_cff_off0001610d.bin` `c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29`	pdf-font-stream	PDF embedded font (cff) at offset 0x1610D	3996 bytes
`font_09_sfnt_off00019792.bin` `2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x19792	23432 bytes
`font_10_sfnt_off0001cd69.bin` `80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1CD69	52108 bytes
`font_11_sfnt_off00025451.bin` `336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x25451	48764 bytes
`font_12_cff_off0009344e.bin` `b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe`	pdf-font-stream	PDF embedded font (cff) at offset 0x9344E	1390 bytes
`font_16_cff_off000982b2.bin` `498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1`	pdf-font-stream	PDF embedded font (cff) at offset 0x982B2	2026 bytes
`font_17_cff_off00098dd9.bin` `6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820`	pdf-font-stream	PDF embedded font (cff) at offset 0x98DD9	1370 bytes
`font_21_cff_off0009d604.bin` `fbf22266dae0292a560fe4992b55ae8d9a60e5393b8105c8e8d7d4434902074f`	pdf-font-stream	PDF embedded font (cff) at offset 0x9D604	1230 bytes
`u3d_00_off00089573.bin` `48816569ab4f370009a917ef6429edbe09e4dfe8a63b00a0a0f75a904c62ba94`	pdf-3d-stream	PDF U3D 3D stream at offset 0x89573	27449 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.