PDF malware analysis — malicious · bbe9f04aa72a7bf0

MALICIOUS

PDF

114.8 KB

MD5: 5ebdb2f94493607d639c67b0894c51c9 SHA-1: 3ed4b52c66c016de6b50df57e3b69b37e0adeba7 SHA-256: bbe9f04aa72a7bf0ad4b07f343f33fb3462b3bc8128cbc29106bf22fc0db90e6

514 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

This PDF file contains embedded JavaScript and a launch action that executes cmd.exe. The launch action is configured to run a command that appears to be related to file operations and potentially executing another payload. The embedded file 'fiche_de_paie.pdf' is detected as a Windows executable by ClamAV, indicating it's likely the second-stage payload. The combination of PDF launch actions, embedded executables, and command-line execution strongly suggests a malicious dropper.

Machine Learning

Nyx PDF Classifier malicious score 0.9970

Heuristics 11

Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240

PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
Launch action critical PDF_LAUNCH

PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD

PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND

PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\fiche_de_paie.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH

An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
ClamAV: Pdf.Dropper.Agent-7217064-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7217064-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
/Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS

PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 11

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`fiche_de_paie.pdf` `d856e13d3cb72127a2ca930a39ef8fd91775e1d1088e47c91ca4b567376bb533`	pdf-embedded-file	PDF EmbeddedFile object 70 at offset 0x11A8A	73802 bytes
Detection ClamAV: Win.Trojan.MSShellcode-7 Obfuscation or payload: unlikely
`javascript_obj0071_000.js` `6cd4ee909b92cf7de72b676e401eb34e5224366a7ff04331b9a18373c9079d69`	pdf-javascript-stream	PDF /JS object 71 at offset 0x1C6C8	62 bytes
`icc_00_off00003fd5.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x3FD5	3144 bytes
`icc_01_off00004aab.icc` `61cfd900e5194258adf98bcb3d44311afa42d9c0372d2050ffd9e6975a4d069c`	pdf-icc-profile	PDF ICC profile at offset 0x4AAB	2036 bytes
`icc_02_off00004fa7.icc` `0fb37c4328cacebb547210723e15a9fe040ef5a17e5b496e993ca68db0126a88`	pdf-icc-profile	PDF ICC profile at offset 0x4FA7	2008 bytes
`font_00_sfnt_off000057d6.bin` `c78989a39e084c41c90c53241bcaf5cd50189902472be290818e9e8e900e3ced`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x57D6	12488 bytes
`font_01_sfnt_off000074af.bin` `0b07bd34e8c46e01a77719b65de93d092eeb040ce587cf72ff5967f7d93ddb3d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x74AF	11256 bytes
`font_02_sfnt_off00009227.bin` `95a1a63bb1c056b2c8ecdc68a7209dd3f9a566494a98e2b5ec63f2f7b3e0fef4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9227	15988 bytes
`font_03_sfnt_off0000be7c.bin` `ac1efaaa2671d1753e3096a93c10ebad68cbe98153922cd9e87999c7e37951b8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBE7C	5468 bytes
`font_04_sfnt_off0000cd80.bin` `11500a68480e170167444eef89ccc470dc43feb7e1051d64b83381581557bf2d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCD80	20744 bytes
`font_05_sfnt_off00010735.bin` `85e8776995a5d9d6f3c2d58554827a13b01c6d8d8cfd5e936929c5faa2b79c90`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10735	5060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.