Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc824c6b88b4bef1…

MALICIOUS

PDF

4.0 KB
MD5: 5b6f8a0b84e50d27f600809c512b301b SHA-1: 28653224993ecf05ba9511def603bd8b9060168b SHA-256: bc824c6b88b4bef174fe5b2ef83e7ee7168632da92280df1e393fbb78587cf26
178 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. Critical vulnerabilities CVE-2009-4324 (media.newPlayer) and CVE-2007-5659 (Collab.collectEmailInfo) were detected, suggesting the JavaScript is designed to exploit these flaws. The JavaScript itself appears obfuscated, making its exact payload difficult to determine, but the presence of these exploits strongly implies an intent to compromise the user's system.

Heuristics 6

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009.
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits.
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
9cf7f9c5a396f8c82fac934bd68daeda27493efe42f1edb75be43a40a6e87a98		 pdf-javascript-stream PDF /JS object 7 at offset 0x2A5 3096 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s).
javascript_obj0007_001.js
be4a8de7c1c462e2902fb55d55a57901a449ffe788b25926d3d816e4899a5486		 pdf-javascript-stream PDF /JS object 7 at offset 0x2A5 48 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.