PDF malware analysis — malicious · be4f14bf8d286cb3

MALICIOUS

PDF

1.34 MB

MD5: 1a0091aac4d7ef86c0a79d2723ea829e SHA-1: ca2891303c9e275f0fc4d6831e37a22ad2ff1757 SHA-256: be4f14bf8d286cb3de45fa4cb2aeeac16d34ae42ac05e2aef83975d33a8c3917

286 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF document contains embedded JavaScript and RichMedia (Flash) content, which is indicative of an exploit attempt. Specifically, the 'CVE_2011_0611_FLASH_RICHMEDIA' heuristic firing points to an exploit targeting Adobe Flash Player. The embedded JavaScript, particularly in 'javascript_obj0029_000.js', appears to be involved in downloading and executing a second-stage payload, as suggested by the 'generic_stage_recovery' heuristic. The presence of XFA forms further supports the exploit vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 11

Adobe Flash Player RichMedia exploit critical CVE likely CVE_2011_0611_FLASH_RICHMEDIA

PDF combines RichMedia Flash activation with an embedded AS3 SWF loader (ByteArray/loadBytes) and shellcode heap-spray staging. This is the static exploit shape associated with CVE-2011-0611 Flash content delivered through Adobe Reader.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.1/

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`5.swf` `59d1843c79e347826e19d6e0062a0d05953ae67af013a3b9265ccca4f425aa1f`	pdf-embedded-file	PDF EmbeddedFile object 50 at offset 0x31D6	2925 bytes
`javascript_obj0029_000.js` `bbc1d3af06a151ecadb438eb05ddac3d422c9041c4e925cea2947eb6def0d938`	pdf-javascript-stream	PDF /JS object 29 at offset 0x334EA	19439 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`javascript_obj0038_001.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 38 at offset 0x19E8	1242 bytes
`javascript_obj0039_002.js` `90b2085c0223b206e7a0f65394a710a11770b73a6699dcb5355bea3dd314d83f`	pdf-javascript-stream	PDF /JS object 39 at offset 0x1FB9	3854 bytes
`javascript_obj0056_003.js` `eab5e6c97c078ea01a27ea6b046480c335555b429356238194699f9c32cfb87d`	pdf-javascript-stream	PDF /JS object 56 at offset 0x26FC	1155 bytes
`stream_004_off000009f6.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x9F6	434 bytes
`generic_stage_recovery_000.js` `24f6910a8db95199125f3c4d93887769b573278455bd2e91ce5d76c7625f8802`	deobfuscated-js	generic stage recovery marker-QQ-to-%u from JavaScript object 29 at offset 0x334EA	19395 bytes
`generic_stage_recovery_001.js` `ea0108a2afc855fe4e44232496719e278bd3a182fbbf21069a9dfa0a74ec26d0`	deobfuscated-js	generic stage recovery marker-QQ-to-%u from JavaScript object 29 at offset 0x334EA	13008 bytes
`generic_stage_recovery_002.js` `d92a8bc064d30bd603de73820eb1bb39ccdf87ed0df11bda451f2af98dfe5f2c`	deobfuscated-js	generic stage recovery marker-QQ-to-%u from combined JavaScript objects at offset 0x334EA	25649 bytes
`generic_stage_recovery_003.js` `a94d14872893b0de87164f50ca095997449f247215132b9feff35a2a401784e6`	deobfuscated-js	generic stage recovery marker-QQ-to-%u from combined JavaScript objects at offset 0x334EA	19262 bytes
`generic_stage_recovery_004.js` `774a994aba83c15a7ef9be06928937e7a1fcaae40335452b7bcb6657fa8c0e9c`	deobfuscated-js	generic stage recovery marker-AAAAA-to-%u from decompressed stream at 0xB39 at offset 0xB39	7344 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`generic_stage_recovery_005.js` `46570532b160b9cebc11deb9d00ec963f19035c32d2da06485f95dd8b6379fd4`	deobfuscated-js	generic stage recovery marker-AA-to-%u from decompressed stream at 0xB39 at offset 0xB39	7357 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`generic_stage_recovery_006.js` `8298bfca0b5c87254d64f1f8ec2391026f2ac86ea9e82a57f7a94d30176adca8`	deobfuscated-js	generic stage recovery marker-ffffffff-to-%u from decompressed stream at 0xB39 at offset 0xB39	1799 bytes
`generic_stage_recovery_007.js` `135eea5e4b327c18a6be6c1698226fe564835650ff3ae93de584679239529170`	deobfuscated-js	generic stage recovery marker-AAAAA-to-%u from decompressed stream at 0x164D at offset 0x164D	7325 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`generic_stage_recovery_008.js` `07dccdb49efdcc3ff51ea61e48e0bf7aa9979655b58daa0ba36f5ca2c75926fd`	deobfuscated-js	generic stage recovery marker-AA-to-%u from decompressed stream at 0x164D at offset 0x164D	7357 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`generic_stage_recovery_009.js` `9633f55d936840d68d7b453012b8d4a8c5338b98f21dae6f5c5d3ca2a21b9486`	deobfuscated-js	generic stage recovery split-literal-normalize -> marker-QQ-to-%u from combined JavaScript objects at offset 0x334EA	25643 bytes
`generic_stage_recovery_010.js` `0bfb600dee43cf6b320e3d5f799ce7f8332db8c836efc62d6798fdb90128f00c`	deobfuscated-js	generic stage recovery split-literal-normalize -> marker-QQ-to-%u from combined JavaScript objects at offset 0x334EA	19256 bytes
`font_00_sfnt_off00001493.bin` `823021e67c69104f3db2966cb1f6abc7103a6715ef1bffc315b5f9c5ea04a787`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1493	7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.