PDF malware analysis — malicious · a594ca7603f9ae3f

MALICIOUS

PDF

200.6 KB Created: 2010-09-25 23:08:23 Authoring application: Advanced PDF Repair at http://www.datanumen.com/apdfr/ (via PlotSoft PDFill 8.0)

MD5: aa976eb0ab34ee5f332c6984fcd082c7 SHA-1: cb54cf0073e4e5d9828e65e212d74ee1bcafd36f SHA-256: a594ca7603f9ae3fb768c3e3ccca93a48ee4bef4335e3f4dfc49f20342be7bf7

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript and exploits CVE-2010-2883, indicating an attempt to compromise the user's system. The embedded JavaScript streams and a secondary embedded PDF suggest a multi-stage attack. The primary external URI observed is http://www.bohongjx.cn, which is likely used to host or retrieve the next stage of the payload.

Heuristics 8

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
External URI info PDF_URI

PDF contains an external URL action
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.datanumen.com/apdfr/
- http://www.bohongjx.cn

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0019_000.js` `86ec0f5e301e75c300c8cd721f5b8ee2f50a0ff6f4764afaae146adfbc716579`	pdf-javascript-stream	PDF /JS object 19 at offset 0xE59	14973 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`javascript_obj0020_001.js` `d8bbcc5984e6bec8996e18881fad0486ff520c9b9f03ee0fb9694ddfc412340d`	pdf-javascript-stream	PDF /JS object 20 at offset 0x490D	1572 bytes
`javascript_obj0021_002.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 21 at offset 0x4BCB	1242 bytes
`stream_015_off00004f40.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4F40	434 bytes
`polyglot_child_pdf_off00028a46.pdf` `5db558c4adfe0aa7fcdeab4a41fb3bd9f2abb565a3d7aa3f4855b8b0c3f3dbd6`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x28A46	38921 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.