MALICIOUS
368
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.003 Windows Command Shell
T1105 Ingress Tool Transfer
T1204.001 User Execution: Malicious Link
T1059.001 PowerShell
The PDF file contains embedded JavaScript and a critical PDF_LAUNCH heuristic firing, indicating an attempt to execute a command. Specifically, the PDF_LAUNCH_COMMAND heuristic shows the execution of 'cmd.exe' with parameters that suggest the exploitation of CVE-2010-1240. This exploit chain likely leads to the execution of an embedded PE payload, as indicated by the PDF_EMBEDDED_PE_PAYLOAD heuristic. The ClamAV detection further confirms the malicious nature of the file.
Heuristics 10
-
Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
-
TrueType bitmap font + active content — CVE-2023-26369 related high PDF_CVE_2023_26369_RELATEDPDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOADPDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\original.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
-
ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Tool.Agent-1388586
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0341_000.js984dc947e3990b672a0fd08a6d6a748764f8ebb7e4ccd5dd4103b775a13e0e89 |
pdf-javascript-stream | PDF /JS object 341 at offset 0x121E11 | 57 bytes |
stream_048_off000a6e66.bin49167ec59566ad0c4ce724558357f7a21093dd9fe04526e67c3cb0bb56158546 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA6E66 | 138316 bytes |
stream_050_off000c3c33.binff496edba2e4f2b31a251379d48591a214f2dab58955af2f5cdca4a325a83ff8 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xC3C33 | 110336 bytes |
stream_052_off000cfc75.bind550b9a2f7dba00e938834c9a9f744a9b3960b847eb2ac504668188669b181d6 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xCFC75 | 87648 bytes |
stream_064_off001057f4.bin777a5260a3ec3bf11cd1b5f58452603be6ae1e8f2489cb4609eb9e6e02a2a53f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1057F4 | 472036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.