PDF malware analysis — malicious · a62066e4784d2f97

MALICIOUS

PDF

2.5 KB

MD5: 8b4e449d3df44a7cfa18cd9f15468909 SHA-1: 11238c66a0a18571b11fd2466505f701ff732646 SHA-256: a62066e4784d2f97474100b5c7d963e1b2214428f5848f9576efbfe420955187

76 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The PDF file contains an embedded XFA form that triggers the CVE-2010-0188 exploit in Adobe Reader. This vulnerability is known to be used for arbitrary code execution, likely to download and execute a second-stage payload.

Heuristics 3

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `331e88904ef004e9836e5fffeb37a764b39f0c3b3974f97d11f0dabd153dfbf7`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x51	13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.