PDF malware analysis — malicious · bbf6f64b3e216e81

MALICIOUS

PDF

619.9 KB Created: 2008-09-07 22:47:39 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12; modified using iText 2.1.7 by 1T3XT)

MD5: ea930c6a7e01779c9a497db6c74fdf90 SHA-1: 97958561ac1b455f388af3ae5af4c71cee7508d6 SHA-256: bbf6f64b3e216e811516d22cee1d95d39d156b293948d827191d0f5e9ea1dd5b

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detection and ML classifier output strongly indicate malicious intent. The presence of embedded JavaScript, specifically a stream flagged as PDF_JS and utilizing String.fromCharCode, points to an exploit attempt. The ClamAV signature 'Pdf.Exploit.CVE_2009_0927-1' directly identifies the CVE-2009-0927 vulnerability being exploited. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9524

Heuristics 5

ClamAV: Pdf.Exploit.CVE_2009_0927-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.CVE_2009_0927-1
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0319_000.js` `ce7fd8321dd40342039e226bea94f559839ff06438f4a70bf50d7de82620ee4b`	pdf-javascript-stream	PDF /JS object 319 at offset 0x8FE5C	4691 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`icc_00_off000159a7.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x159A7	3144 bytes
`font_00_sfnt_off00004453.bin` `336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4453	48764 bytes
`font_01_cff_off0000d5ed.bin` `38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2`	pdf-font-stream	PDF embedded font (cff) at offset 0xD5ED	357 bytes
`font_02_cff_off0000da96.bin` `2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca`	pdf-font-stream	PDF embedded font (cff) at offset 0xDA96	499 bytes
`font_03_cff_off0000dfc3.bin` `755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2`	pdf-font-stream	PDF embedded font (cff) at offset 0xDFC3	2550 bytes
`font_04_cff_off0000ed11.bin` `eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c`	pdf-font-stream	PDF embedded font (cff) at offset 0xED11	3369 bytes
`font_05_cff_off0000fcba.bin` `ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d`	pdf-font-stream	PDF embedded font (cff) at offset 0xFCBA	2951 bytes
`font_06_cff_off00010aef.bin` `650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7`	pdf-font-stream	PDF embedded font (cff) at offset 0x10AEF	5979 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.40, consistent with packed or encrypted content.
`font_07_cff_off0001236f.bin` `91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a`	pdf-font-stream	PDF embedded font (cff) at offset 0x1236F	1949 bytes
`font_08_cff_off00012f82.bin` `cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751`	pdf-font-stream	PDF embedded font (cff) at offset 0x12F82	6612 bytes
`font_09_cff_off00014ba3.bin` `c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29`	pdf-font-stream	PDF embedded font (cff) at offset 0x14BA3	3996 bytes
`font_10_sfnt_off00018228.bin` `2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18228	23432 bytes
`font_11_sfnt_off0001b7ff.bin` `80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1B7FF	52108 bytes
`font_13_cff_off00088185.bin` `b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe`	pdf-font-stream	PDF embedded font (cff) at offset 0x88185	1390 bytes
`font_17_cff_off0008cfe9.bin` `498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1`	pdf-font-stream	PDF embedded font (cff) at offset 0x8CFE9	2026 bytes
`font_18_cff_off0008db10.bin` `6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820`	pdf-font-stream	PDF embedded font (cff) at offset 0x8DB10	1370 bytes
`font_22_cff_off00093610.bin` `fbf22266dae0292a560fe4992b55ae8d9a60e5393b8105c8e8d7d4434902074f`	pdf-font-stream	PDF embedded font (cff) at offset 0x93610	1230 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.