PDF malware analysis — malicious · c8cee6e291acbffc

MALICIOUS

PDF

2.5 KB

MD5: 584dd2e3ae3309e03238145158adc32d SHA-1: 9091444333baae276f1dd377e30128b514c6ac7c SHA-256: c8cee6e291acbffc540a3fe464becc4972417598afc81ce2e9d3c89163bfe622

76 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.001 Spearphishing Attachment T1204 User Execution

The critical heuristic firing indicates the PDF exploits CVE-2010-0188, a known vulnerability in Adobe Reader related to XFA forms and TIFF image parsing. This exploit is used to deliver a malicious payload. The embedded file further supports the malicious nature of the document.

Heuristics 3

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `e9939f224d90e623b95cdca3905a754eee6c958bd573dc4c0da5653368c6a860`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x51	13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.