MALICIOUS
76
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1566.002 Spearphishing Attachment
The PDF file contains an embedded XFA form that triggers the CVE-2010-0188 exploit. This vulnerability is known to be used for delivering malicious payloads. The exploit targets a vulnerability in Adobe Reader's handling of TIFF images within XFA forms. No document body text was available for analysis, but the critical heuristic firing strongly indicates exploitation.
Heuristics 3
-
Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
XFA form low PDF_XFAPDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_file_obj0001.bin086cb19a5de3dc4e5290e8a57f5f5efbf7368bf00657e448b5f8ae1ae58ecc78 |
pdf-embedded-file | PDF EmbeddedFile object 1 at offset 0x51 | 13581 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.