PDF / .TMP malware analysis — malicious · c2633135995d9ee4

MALICIOUS

PDF / .TMP

216.9 KB Created: 2010-04-23 16:54:43 +08:00 Authoring application: Adobe Designer 7.0

MD5: c28d1f447bc23f21065dda2784d98fe9 SHA-1: 36c370a6416adb0bf3831dc0d0c38cb6a3693516 SHA-256: c2633135995d9ee4e3973ccbc658e3e095f01eef188c223ce1f78204cef5c19c

262 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell

The PDF file contains XFA (XML Forms Architecture) which is known to be a vector for exploits. Specifically, the 'PDF_XFA_HEAP_SPRAY' and 'CVE_2010_0188' heuristics indicate the presence of exploit code targeting a heap spray vulnerability in Adobe Reader. The embedded JavaScript streams and the 'POLYGLOT_CHILD_PDF_STATIC_TRIAGE' finding further suggest malicious scripting activity designed to download and execute a secondary payload.

Heuristics 12

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT

PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY

PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/

Extracted artifacts 13

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0033.bin` `c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb`	pdf-embedded-file	PDF EmbeddedFile object 33 at offset 0x74E9	85 bytes
`embedded_file_obj0034.bin` `c3e1960ce8b7916804612ba3ca5a7383bd8329a68775ea4b0663e450b46fc6c3`	pdf-embedded-file	PDF EmbeddedFile object 34 at offset 0x759B	1675 bytes
`embedded_file_obj0035.bin` `4ad0facd5457d1a89335a2900a52642831e54a79cb389c0be49c88c9eb09a232`	pdf-embedded-file	PDF EmbeddedFile object 35 at offset 0x788E	5264 bytes
`embedded_file_obj0036.bin` `ed762fbdece2f28698a9b616738dad71743a6f16ae241aac314fe0a6ffbde9b6`	pdf-embedded-file	PDF EmbeddedFile object 36 at offset 0x80B1	11668 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`embedded_file_obj0037.bin` `9de85e34edf3e917e689a8038021a103f1a74681300a3e2b9c5fc0f1e5334c45`	pdf-embedded-file	PDF EmbeddedFile object 37 at offset 0x82CA	2228 bytes
`embedded_file_obj0038.bin` `57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f`	pdf-embedded-file	PDF EmbeddedFile object 38 at offset 0x8585	212 bytes
`javascript_obj0025_000.js` `4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb`	pdf-javascript-stream	PDF /JS object 25 at offset 0x6D72	870 bytes
`javascript_obj0027_001.js` `4e139c8b22ec16bd5aa51575c80dec2bbf89b76977a06b68473031a0eb206366`	pdf-javascript-stream	PDF /JS object 27 at offset 0x6EF6	2794 bytes
`javascript_obj0029_002.js` `c876171bd867b66b7671fb337ff9e57d18cd15b43d344cf5a7243821300a408a`	pdf-javascript-stream	PDF /JS object 29 at offset 0x71E5	1528 bytes
`stream_020_off00034db7.js` `9134c785972e8c1e54fe92812f50f80331dd11280d06f658557d556d16384ae2`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x34DB7	4517 bytes
`font_00_cff_off00001217.bin` `23831e143e2e1a484b95ee765b15d94562c951468b895c080e655667dc04ddf0`	pdf-font-stream	PDF embedded font (cff) at offset 0x1217	31178 bytes
`font_01_sfnt_off000308a7.bin` `78fe6a894c1b462851cea455109277db663b429c3ede1d4ef1e6360fea641bad`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x308A7	179276 bytes
`polyglot_child_pdf_off00030319.pdf` `d9963c9b829cade1dc2147cbf3fc0f0cd47df6df71d9b610c97fabc789b5c174`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x30319	24688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.