Malicious PDF — malware analysis report

Static analysis result for SHA-256 bef5ca7adf615d3a…

MALICIOUS

PDF

6.7 KB Created: 2008-08-02 00:59:33 +04:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 6.0 (Windows))
MD5: 7b2e4edc92621705bd63fcd60dde8c4e SHA-1: 71baf87b2e9e1548e9036533bd12d1c513dd8b17 SHA-256: bef5ca7adf615d3ade60c9fa882e5c6a0cf99b59699247e8827e40fc9009a733
156 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The critical CVE_2007_5659 firing suggests exploitation of a known vulnerability in Adobe Reader via the Collab.collectEmailInfo method. The embedded JavaScript stream, named javascript_obj0012_000.js, is likely responsible for executing the exploit and downloading a secondary payload. The benign URLs extracted do not contribute to the maliciousness assessment.

Heuristics 6

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
e455881d6326374e0b1b32a2e665815f0320a90e6f16feb4d571c68b55251b87		 pdf-javascript-stream PDF /JS object 12 at offset 0x384 5093 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 16 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.