MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF file contains embedded JavaScript, which is triggered by the CVE-2008-2992 exploit. The JavaScript stream is obfuscated but the presence of util.printf and ASCIIHexDecode/ASCII85Decode filters strongly indicates the execution of arbitrary code. This is a common technique for delivering further malicious payloads.
Heuristics 6
-
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
-
ClamAV: Pdf.Exploit.Agent-36183 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-36183
-
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEXHex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0006_000.jsf86b1e5220183f7c7e3ea8cddca0c8beed42f4aca8952f8c95b07b9823f2ed6e |
pdf-javascript-stream | PDF /JS object 6 at offset 0x138 | 1345 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.