PDF malware analysis — malicious · be063970e50a9c0e

MALICIOUS

PDF

807.5 KB

MD5: bc59db3a039cd01ec5f32bd853eaced3 SHA-1: e89924593b156955bdf34cb15f094b452cdace9c SHA-256: be063970e50a9c0e111b8554d589f8f36329ce4bda1d07c7fc94c546489b612b

118 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and triggers heuristics related to CVE-2023-26369. The presence of eval() calls within the JavaScript suggests code execution, likely to download and execute a second-stage payload. The high stream count and obfuscation indicators point towards a deliberate attempt to conceal malicious activity.

Heuristics 7

TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED

PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
Unusually high stream count medium PDF_MANY_STREAMS

PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/pdfx/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/iX/1.0/

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00000e5b.js` `2b071df929c05654f72077c7ee065adf5737ae835836e3c7519c4eaa6efbe205`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xE5B	928 bytes
`stream_004_off0000102d.js` `a7b6134117329fdd129ec5143c070019aa448e01b599fca193cb6787845ec786`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x102D	1233 bytes
`stream_006_off0000157d.js` `edf27b97ca5533b1482f126283f0a169d3dd1dd63059ba0201e8599590339d98`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x157D	4720 bytes
`stream_007_off00001bfe.js` `5dc825a345efe5e078ad9ec1684ba5d192fdd7934134de2e788cee9f8b089aac`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1BFE	262 bytes
`stream_010_off00001fe3.js` `86b34d7cd1185ba895e901fbca0e6b245a7778f87f0b60b5df4482db1200d384`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1FE3	1656 bytes
`stream_011_off00002297.js` `77468418a7c15cf66abc810fe1bcdbbdf9e389ec97f8cde200a0fed65c7f1ca7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2297	829 bytes
`stream_012_off0000247d.js` `07707251746d909fbaaac180bbb1c38ba5d42d3c8ee80b844efbc76a1050da70`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x247D	365 bytes
`stream_013_off000025cd.js` `3076def4c60ef8515a22d0431bbf1df75052f658330778792a4172ff2a2482ac`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x25CD	1959 bytes
`stream_014_off0000291c.js` `3c4718d5b4722e6302a5956d94c9292ffa8bca5b293d7b4d2fb92ad68b7a1803`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x291C	1278 bytes
`stream_017_off00002ebd.js` `2ce65c25db81d7839cea6ac75003f5e1b7f9c8ad0b46d40c46f162ed2db0710a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2EBD	322 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`stream_076_off00008a54.bin` `e79626691d2f8807cec910c0da57c8fee0ff0a8e2ca266c84cc0c0b4405e8019`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8A54	351535 bytes
`stream_095_off000462e3.bin` `cf1bee61e3dccd9ed4b09b4a8f1629993f826c5ca03d6babdf4ebda9d03f0c30`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x462E3	11268 bytes
`stream_134_off000593ce.bin` `854d02e760f683bd5d04702d11854e7adfbfd0ad9c36e2e127b45bc25c636aae`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x593CE	352721 bytes
`stream_141_off000887cd.bin` `ea85af52c9808a7f4a463ed16fd06d40dbea2d5a93beb7f1f2b5739929b31712`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x887CD	46800 bytes
`objstm_1979_00.bin` `8ab4d03c370c4cb3e17259713b2d26ea3aa3beb2b7bc43749b271d09fe835e56`	pdf-objstm-decoded	PDF /ObjStm 1979 0 obj (inflated)	19989 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`objstm_1994_00.bin` `3c994a284b49684f0bfbfcd9c1d23bb168bc072882b7d5aaece767a6c82e3dbd`	pdf-objstm-decoded	PDF /ObjStm 1994 0 obj (inflated)	2457 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`objstm_0285_00.bin` `275434376f5010f53f99c396d5bdceb3ec24f302316718124d83f54691712a0e`	pdf-objstm-decoded	PDF /ObjStm 285 0 obj (inflated)	22042 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`objstm_0286_00.bin` `99f37926bf27cc4307c605285e2fa0736fb8422ca9d7d896702175fd3f6f12b9`	pdf-objstm-decoded	PDF /ObjStm 286 0 obj (inflated)	16841 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.