Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf1b8b10d283cad0…

MALICIOUS

PDF

97.8 KB Created: 2009-07-28 16:23:15 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)
MD5: 26fd7393273bf9877a6c0a8abccd0c11 SHA-1: b3e342eedfaec85c5818695def69255b7c827541 SHA-256: cf1b8b10d283cad0d175466e56ce71e697ef6c1e8bfd1cda3c0bd999ca0d2123
190 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell T1566.001 Spearphishing Attachment

This PDF sample was flagged by ClamAV as Pdf.Dropper.Agent-7306148-0, indicating it functions as a dropper. Heuristics indicate the presence of JavaScript actions and embedded JS streams, with a specific alert for CVE-2023-26369 related components. The ML classifier also strongly indicated maliciousness. The primary function appears to be exploiting a PDF vulnerability to execute embedded JavaScript, which likely downloads and executes a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 6

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • ClamAV: Pdf.Dropper.Agent-7306148-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7306148-0
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0029_000.js
78b7f89807b0cac37538dfb149b2737b4ce9142486594e4c5be2f5231ca39e56		 pdf-javascript-stream PDF /JS object 29 at offset 0x158EE 52 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
javascript_obj0030_001.js
e8f8606f8d77779cb4c2c4369a87712575f8d30dd9aded5dbc3366cdb501e3ca		 pdf-javascript-stream PDF /JS object 30 at offset 0x15971 44061 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.