MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.001 PowerShell
The PDF file contains embedded JavaScript and triggers a critical heuristic for CVE-2009-0927, indicating exploitation of a vulnerability in Adobe Reader via the Collab.getIcon method. The presence of JavaScript and the specific CVE exploit strongly suggest an attempt to execute arbitrary code. No specific malware family could be identified.
Heuristics 5
-
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution.
-
ClamAV: Pdf.Exploit.CVE_2009_0927-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.CVE_2009_0927-1
-
unescape() call high PDF_UNESCAPEunescape() found — often used to decode shellcode in PDF JS exploits
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Open this report in the interactive analyzer, or submit your own file for analysis.