Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8b1166a28d760d3…

MALICIOUS

PDF

114.9 KB
MD5: 792e856c55ecc0baf13597516e8ce152 SHA-1: d21db8d6a7e959f1572b6c8c6725a85a55fddf37 SHA-256: a8b1166a28d760d304858d9d28de1a986e304e3c8a128c65be3b9e91cadfd43d
514 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 User Execution: Malicious Link T1140 Deobfuscate/Decode Files or Information T1027 Obfuscated Files or Information

The PDF contains embedded JavaScript and an embedded executable disguised as a PDF file named 'fiche_de_paie.pdf'. The critical PDF_LAUNCH_COMMAND heuristic indicates that cmd.exe is executed with parameters that attempt to change the directory and potentially execute the embedded payload. The embedded executable was detected by ClamAV as 'Win.Trojan.MSShellcode-7', and the PDF itself was flagged by ClamAV as 'Pdf.Dropper.Agent-7290771-0'. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 11

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\fiche_de_paie.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • ClamAV: Pdf.Dropper.Agent-7290771-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7290771-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
fiche_de_paie.pdf
5e52a9d8320d3096f72c72cb0f19a283eec72a67488239eee25e39b0fe47ed4f		 pdf-embedded-file PDF EmbeddedFile object 70 at offset 0x11A8A 73802 bytes
Detection
ClamAV: Win.Trojan.MSShellcode-7
Obfuscation or payload: unlikely
javascript_obj0071_000.js
6cd4ee909b92cf7de72b676e401eb34e5224366a7ff04331b9a18373c9079d69		 pdf-javascript-stream PDF /JS object 71 at offset 0x1C702 62 bytes
icc_00_off00003fd5.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x3FD5 3144 bytes
icc_01_off00004aab.icc
61cfd900e5194258adf98bcb3d44311afa42d9c0372d2050ffd9e6975a4d069c		 pdf-icc-profile PDF ICC profile at offset 0x4AAB 2036 bytes
icc_02_off00004fa7.icc
0fb37c4328cacebb547210723e15a9fe040ef5a17e5b496e993ca68db0126a88		 pdf-icc-profile PDF ICC profile at offset 0x4FA7 2008 bytes
font_00_sfnt_off000057d6.bin
c78989a39e084c41c90c53241bcaf5cd50189902472be290818e9e8e900e3ced		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57D6 12488 bytes
font_01_sfnt_off000074af.bin
0b07bd34e8c46e01a77719b65de93d092eeb040ce587cf72ff5967f7d93ddb3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74AF 11256 bytes
font_02_sfnt_off00009227.bin
95a1a63bb1c056b2c8ecdc68a7209dd3f9a566494a98e2b5ec63f2f7b3e0fef4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9227 15988 bytes
font_03_sfnt_off0000be7c.bin
ac1efaaa2671d1753e3096a93c10ebad68cbe98153922cd9e87999c7e37951b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBE7C 5468 bytes
font_04_sfnt_off0000cd80.bin
11500a68480e170167444eef89ccc470dc43feb7e1051d64b83381581557bf2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD80 20744 bytes
font_05_sfnt_off00010735.bin
85e8776995a5d9d6f3c2d58554827a13b01c6d8d8cfd5e936929c5faa2b79c90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10735 5060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.