PDF malware analysis — malicious · b0b6d4433655651b

MALICIOUS

PDF

341.0 KB Authoring application: PyPDF2

MD5: e00ff9065eaf8851cb1ec945436a0f00 SHA-1: 5343ea3c90e6ad59fffba6298ae44aed603a2a07 SHA-256: b0b6d4433655651be727ef6d1eddfeb5147e44dfdebf44fcf935df0fa07700dc

198 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1059.005 Visual Basic

The PDF file contains embedded JavaScript and exploits the CVE-2009-0658 vulnerability, which is known to be used for dropping malicious content. The presence of `eval()` calls and JBIG2 decoding with active content further indicates malicious intent. The primary attack vector appears to be the exploitation of Adobe Reader to execute a script that likely downloads and executes a second-stage payload.

Heuristics 8

Adobe Reader JBIG2Decode WScript dropper exploit critical CVE likely CVE_2009_0658

PDF combines JBIG2Decode image streams with OpenAction JavaScript that reconstructs a Windows Script Host dropper stage. This matches the in-the-wild Adobe Reader/Acrobat JBIG2 image-stream exploit cluster associated with CVE-2009-0658.
JBIG2 + active content high CVE related PDF_JBIG2_ACTIVE_CONTENT

JBIG2Decode appears with JavaScript/XFA/RichMedia — a related indicator for JBIG2 parser-exploit families including CVE-2021-30860 and CVE-2009-0658, but not a unique CVE fingerprint.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JBIG2Decode filter medium PDF_JBIG2

JBIG2 image decoder present — historically used in zero-click exploits
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 14

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0014_000.js` `c813fc130b2327e07f91c39db3fa368ce7a9195f3b9a68380d45a855d41982cf`	pdf-javascript-stream	PDF /JS object 14 at offset 0xD4F	95241 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`javascript_obj0014_001.js` `029f3b0ed8ec5ca035007eda9b38f4711553f9907dce33cd8893407496f3ab53`	pdf-javascript-stream	PDF /JS object 14 at offset 0xD4F	93873 bytes
`new_array_token_stage_000.js` `ed1ab28493e5a630dfda822cbff1dedac5b61229f16400ba8b5fc1f9057582cf`	deobfuscated-js	new-array token-map decoded JavaScript object 14 at offset 0xD57	16964 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`jbig2_00_off00020b91.bin` `4495a1ab2df25967174ca7a7d567633df07fa327ed53e0463eb541ceb329f143`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x20B91	3739 bytes
`jbig2_01_off00021fe4.bin` `0509dee62737e9d98da570e97853f24fd8e845a6eabe26b920817bb3ceeaf1c4`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x21FE4	4549 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.47, consistent with packed or encrypted content.
`jbig2_02_off000241d0.bin` `43fed9b1046d528306c0e8cd39f93f0a7de4ce68f1dff96896e2a428f88cb01b`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x241D0	23934 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`jbig2_03_off0002b1ed.bin` `916d69091c31049d0e2f61128ca6664fbd156aa76c20dc9a4b8af7089c3126f5`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x2B1ED	28359 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.48, consistent with packed or encrypted content.
`jbig2_04_off0003353e.bin` `3076e67719c4fab59c91fa1e557b50d0f642434399fa19557f41324e7eb99e38`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x3353E	28948 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.50, consistent with packed or encrypted content.
`jbig2_05_off0003bb3e.bin` `f51c1a712f441d0678f2b89adf953f633b27b20cb2a4e2d980521d73ccdaed35`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x3BB3E	28127 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`jbig2_06_off0004382b.bin` `58067e40972bb61bf28d388016a13b675940822f7d3c1f52bd6b54cdad3b74b3`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x4382B	14399 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.47, consistent with packed or encrypted content.
`jbig2_07_off00047c4d.bin` `da28672e3b94bb50a8382c321d27605b8fd13d1836cf5c75b58bfe78410be9a8`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x47C4D	10105 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`jbig2_08_off0004aa1f.bin` `f823fa303fcf1b818006dfa7a8b34d1dfc8153a3c6c27be1f8161d32c9907907`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x4AA1F	13018 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.47, consistent with packed or encrypted content.
`jbig2_09_off0004e712.bin` `1e32ed40c13dbe2cc71fb185c373189d3ec3960ac36f911fbd7b982c15cb8484`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x4E712	11975 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.48, consistent with packed or encrypted content.
`jbig2_10_off00051ff0.bin` `8ed2dd22d9e4aed2e20b7a9363fbbf5d393b1cf97d94d39aa3611d58d52ab9b5`	pdf-jbig2-stream	PDF JBIG2 stream at offset 0x51FF0	10994 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.