Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa00b173b10462f9…

MALICIOUS

PDF

215.7 KB First seen: 2019-05-16
MD5: 9504bd924df8f6f4658b3a78883748b6 SHA-1: 1dd46037ad81d8ea5f9379fa9ae29b5a94aa1d5f SHA-256: aa00b173b10462f9fb65485dafecf13c8fd68e9c3d60487b6beed3246254efc8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The PDF file contains embedded JavaScript and is related to CVE-2023-26369, indicating an exploit attempt. The embedded JavaScript points to a suspicious URL, 'http://fajnebluzy.pl/js/direck.php?ID=klawhgawtawawgaw', which likely serves as a download location for a secondary payload. The heuristic 'SE_URGENCY_LURE' suggests the document's content is designed to prompt immediate user action, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 6

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fajnebluzy.pl/js/direck.php?ID=klawhgawtawawgaw PDF link annotation
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoftReferenced by PDF JavaScript
    • http://en.wikipedia.org/wiki/MIT_LicenseReferenced by PDF JavaScript
    • http://www.microsoft.com/typography/fonts/default.aspxReferenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aReferenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0Referenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@Referenced by PDF JavaScript
    • http://www.microsoft.com/TypographyReferenced by PDF JavaScript
    • https://verifyloginappacc.servehttp.com/_In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0090_00.bin pdf-objstm-decoded PDF /ObjStm 90 0 obj (inflated) 6059 bytes
SHA-256: 9f86f59b023555745eea0bb7b8280eb0873069861b0cad53ced21d2cde1102ab

Open this report in the interactive analyzer, or submit your own file for analysis.