Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb962ee89ac99be5…

MALICIOUS

PDF

423.8 KB Created: 2010-01-06 10:23:21 -03:00 Authoring application: 376377000P000D000F000C000r000e000a000t000o000r000 000V000e000r000s000i000o000n000 0000000.0009000.0003 (via GPL Ghostscript 8.54) First seen: 2026-05-10
MD5: 43ba6a82e3a58803ec26397bcb7e2802 SHA-1: 8c249449eb274218e59f4433b1517e63e5a9ac63 SHA-256: cb962ee89ac99be53df264aa8ae4d14aae6c73100c7161f281b53b6c7d461246
616 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript T1566.001 Spearphishing Attachment

The sample is a PDF file that leverages CVE-2010-1240 to execute cmd.exe via a launch action. The embedded JavaScript `this.exportDataObject({ cName: "exploit", nLaunch: 0 });` is used in conjunction with the launch action to drop and execute a Windows executable payload, identified as Win.Trojan.Rozena-131 by ClamAV. The embedded payload is disguised as 'exploit.pdf' but is detected as a Windows executable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 13

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOAD
    PDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\exploit.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.vivaolinux.com.br/artigo/Metasploit-Adobe-Exploit In PDF document text
    • http://www.vivaolinux.com.br/comunidade/MetasploitIn PDF document text
    • tcp://192.168.70.229:4455In extracted file (exploit.pdf)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
exploit.pdf pdf-embedded-file PDF EmbeddedFile object 127 at offset 0x64E85 37888 bytes
SHA-256: ab255f0f429f385f31e72364faeca4475256076615320763ff67eb0423233326
Detection
ClamAV: Win.Trojan.Rozena-131
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=exploit.pdf; kind=pdf-embedded-file Static shellcode analysis recovered the Metasploit stager connect-back address: 192.168.70.229:4455 (reverse/x86, lab (non-routable)) Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_MSF_BIND, SC_PUSH_STRING Static shellcode analysis recovered API/import strings: GetProcAddress, ExitProcess, LoadLibraryA, VirtualAlloc
javascript_obj0128_000.js pdf-javascript-stream PDF /JS object 128 at offset 0x69B28 56 bytes
SHA-256: 8bd20d24e8d0bf6af527f7c9864433e9d2965f968d51a35ce98cd55aaf263bd5
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "exploit", nLaunch: 0 });
stream_015_off00022f7f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x22F7F 57720 bytes
SHA-256: 1581b77e8c7d7416d5be654fd2ce2199d314216e12bec6a58ce78350fc244768
font_00_sfnt_off0004adda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4ADDA 24444 bytes
SHA-256: d84d3f8a6eb80f233f0948ef65e68131bac10cdc274aab60826cf3fb60fc8c58
font_01_sfnt_off0004e077.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4E077 14644 bytes
SHA-256: bf0d7f0549bfb39f9ea78b25bedb523dad57c84c054b97145e26521f12d72e00
font_02_sfnt_off0005053e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5053E 17984 bytes
SHA-256: 9b6dc377dbbb8ac63e126743b14937d88b0301c259ce2de00db6715e59402f14
font_03_sfnt_off00052916.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52916 28460 bytes
SHA-256: 4de59ee1270ddcf0feccc312464f985dab6ee4d4b2a22fd3197e0de47631123f
font_04_sfnt_off00056d5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56D5F 35320 bytes
SHA-256: 20cb1a803571e0f8a66c8510aa799bc7ad3426cf836651a4862f377805c962d5
font_05_sfnt_off0005c745.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C745 16420 bytes
SHA-256: 8bc0832986956bd0adb9baccb863f12fe915d99a287f71851c8c82330d08f22d
font_06_sfnt_off0005ea28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EA28 27260 bytes
SHA-256: 41d5bc9e7aa11d0ef4950fb660f0d56fe3e5005cf6c469b6c209923afacbd79b
font_07_sfnt_off00062a54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62A54 8196 bytes
SHA-256: c4f3be77f8edc4bc2e6b3498b70536304ace3659c68ba6880e84a782320d437f

Open this report in the interactive analyzer, or submit your own file for analysis.