Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3b63f2200364e1f…

MALICIOUS

PDF

1.07 MB Authoring application: Python PDF Library 055 http072057057pybrary056net057pyPdf057
MD5: e118ba35b8bdd128482551556086cb9c SHA-1: f06d12db26ef3aeb7295d9fadcbbb0795e0596f6 SHA-256: c3b63f2200364e1f2bf0e277fb9791d407de54bde0a38535107da142eea77281
208 Risk Score

Malware Insights

MITRE ATT&CK
T1190 Exploit Public-Facing Application

The file is a PDF containing embedded Flash content and triggers a critical vulnerability (CVE-2011-2462) related to U3D/RichMedia parsing in Adobe Reader. This indicates the PDF is designed to exploit a known vulnerability to deliver a payload. ClamAV also detected it as a dropper, further supporting its malicious nature. No specific script was extracted, but the embedded file 'sploit.swf' likely contains the malicious code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • Adobe Reader U3D/RichMedia parser exploit critical CVE likely CVE_2011_2462_RICHMEDIA_U3D
    PDF combines U3D stream markers with RichMedia and JavaScript/XFA activation surfaces. This is the U3D RichMedia exploit document shape associated with CVE-2011-2462, even though the U3D marker is not exposed through the canonical /Subtype /U3D dictionary.
  • ClamAV: Pdf.Dropper.Agent-7300253-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7300253-0
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adobe.com/AS3/2006/builtin

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
sploit.swf
f20d4773036855e9105ee72056325a2e16f4eedb49cbf128a1bfe1e45cd69660		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x1107D9 781 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.