Malicious PDF — malware analysis report

Static analysis result for SHA-256 be6e03bbf12589fa…

MALICIOUS

PDF

1.13 MB Created: 2010-06-29 18:43:42 Authoring application: Microsoft® Office Word 2007
MD5: 38f59709019d2589e5564a04f2fe672d SHA-1: d9d90553f99b1293d3617d987f264fd878f12768 SHA-256: be6e03bbf12589fab7e748008cc34b0328874bcac129c2905440bced34ffae9f
368 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer T1204.001 User Execution: Malicious Link T1059.001 PowerShell

This PDF file contains embedded JavaScript and a launch action that targets cmd.exe, indicating an attempt to execute arbitrary commands. The critical heuristic CVE_2010_1240 confirms this, specifically noting a chain involving an embedded-file/exportDataObject payload. ClamAV detection as Pdf.Dropper.Agent-7217274-0 further supports its malicious nature. The primary attack vector appears to be exploiting a known vulnerability to download and execute a secondary payload.

Heuristics 10

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\original.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • ClamAV: Pdf.Dropper.Agent-7217274-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7217274-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0341_000.js
984dc947e3990b672a0fd08a6d6a748764f8ebb7e4ccd5dd4103b775a13e0e89		 pdf-javascript-stream PDF /JS object 341 at offset 0x120E4A 57 bytes
stream_048_off000a6e66.bin
49167ec59566ad0c4ce724558357f7a21093dd9fe04526e67c3cb0bb56158546		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA6E66 138316 bytes
stream_050_off000c3c33.bin
ff496edba2e4f2b31a251379d48591a214f2dab58955af2f5cdca4a325a83ff8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC3C33 110336 bytes
stream_052_off000cfc75.bin
d550b9a2f7dba00e938834c9a9f744a9b3960b847eb2ac504668188669b181d6		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCFC75 87648 bytes
stream_064_off001057f4.bin
4e5684333a122014a458d56a5da89e4ba8d96051c03efe5925561a8cec4c5964		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1057F4 461112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.