Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca71c2eed21ee7c8…

MALICIOUS

PDF

1002.6 KB Created: 2002-02-26 08:23:59 -08:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0.5 (Windows)) First seen: 2026-05-11
MD5: e162554c5bc23a77fa0ff3926acd2a9b SHA-1: 4d28878b490d7fc6314d1863d2ed21340a9b2e95 SHA-256: ca71c2eed21ee7c8b4c6a78eade76ddf6fb4d210106ba1eefa1726ed42b7f101
536 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains JavaScript that utilizes the `exportDataObject` function, which is known to be used for launching embedded executables. This action is paired with a PDF launch action targeting `cmd.exe`, indicating an attempt to execute a payload. The embedded artifact, named 'Excel.pdf', is detected as a Windows executable by ClamAV, specifically identified as Win.Trojan.Swrort-5710536-0, and the PDF itself is flagged as Pdf.Tool.Agent-1388586. This suggests a malicious document designed to deliver and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 12

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\Excel.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • https://www.verisign.com/repository/CPS��In extracted file (stream_025_off000ef207.bin)
    • https://www.verisign.comIn extracted file (stream_025_off000ef207.bin)
    • https://www.verisign.com/repository/verisignlogo.gif0��In extracted file (stream_025_off000ef207.bin)
    • https://www.verisign.com/CPS0bIn extracted file (stream_025_off000ef207.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_025_off000ef207.bin)
    • http://www.iec.chIn extracted file (icc_00_off0001176b.icc)
    • http://www.microsoft.com/truetype/0In extracted file (font_04_sfnt_off000ed5b3.bin)

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
Excel.pdf pdf-embedded-file PDF EmbeddedFile object 75 at offset 0xF1987 61440 bytes
SHA-256: 98e9b8bc118bba411d523dd3d24b95427a47d003a5781e214d3119e168194ec7
Detection
ClamAV: Win.Trojan.Swrort-5710536-0
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=Excel.pdf; kind=pdf-embedded-file Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_GETPROCADDRESS, SC_STR_CREATEPROCESS Static shellcode analysis recovered API/import strings: LoadLibraryA, GetProcAddress, CreateFileA, kernel32.dll, KERNEL32.DLL, CreateProcessA
javascript_obj0076_000.js pdf-javascript-stream PDF /JS object 76 at offset 0xFA61A 54 bytes
SHA-256: c7366eff30dd5f64962e708683d232e3675392b5519add6e2ad18bbc95e3090b
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "Excel", nLaunch: 0 });
stream_007_off0001ad1d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1AD1D 627966 bytes
SHA-256: e323e744dbcc08fabbfeadfba1a9f1a11dd0260b874a8c2c924769fb68dbc70c
stream_009_off0003281b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3281B 557598 bytes
SHA-256: dd1e8dd8fcd0b6ff3b4293218d8b55bb706bdba3c53eafde1d2bce1a988db420
stream_011_off0004acb4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4ACB4 687351 bytes
SHA-256: 0358bc8bcdda0d8fcfb12f576d24dd5155e179ee1d82ad817d61c0e7ffc12771
stream_014_off0006793d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6793D 712800 bytes
SHA-256: c87feec872a0fb4d2610618f3c768026756de6da9317a13e8b16fecd9a900669
stream_016_off000863a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x863A5 1136142 bytes
SHA-256: 619b8e2626b835452f067cdf915595f50c8af27b359b6e4731f86414f9c1fc3d
stream_020_off000b9b3f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB9B3F 1147608 bytes
SHA-256: 354675386af81e85a1e8b1d9220c6e65d4e28c0e712337e4b77af3589b5fa6be
stream_025_off000ef207.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF207 10576 bytes
SHA-256: 9d6fd9424d822348ab9c429b909499c9d8061805feb9e4dee3cb4598be607bc0
icc_00_off0001176b.icc pdf-icc-profile PDF ICC profile at offset 0x1176B 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00001cd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CD2 58228 bytes
SHA-256: e198b6686d50b997833a2fed538c8a46060519353eff2f72384f18cc1264cb9f
font_01_sfnt_off0000b376.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB376 42148 bytes
SHA-256: 781910431a05bd55d41fa93b85ace4638e0d9368a19f5f339be00bd0e8206ebe
font_02_sfnt_off000121d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121D5 32480 bytes
SHA-256: ab3e2930f86466dce60508274497437d56bc408a182139250bd3b08d2e608805
font_03_sfnt_off0001726c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1726C 25288 bytes
SHA-256: 95ce4416a18272b7f86c8401328e4a31d3e019c2bf076dd1fd328ebd2f256de0
font_04_sfnt_off000ed5b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED5B3 10628 bytes
SHA-256: e4fa96611789c05bd2d4c886fbf924f355144ffabcc1d7e96fb024febfa54a20

Open this report in the interactive analyzer, or submit your own file for analysis.