PDF static analysis report

Static analysis result for SHA-256 d029a9ba7961459c…

CLEAN

PDF

435.0 KB Created: 2022-06-11 11:23:55 +00:00 Authoring application: 376377000M000i000c000r000o000s000o000f000t000256000 000W000o000r000d000 0002000000010006 (via www.ilovepdf.com) First seen: 2022-10-28
MD5: e7c2bb28bebfb6245da9c053518cb723 SHA-1: 81230af4accff6ab86d8b5c763c06cbf0e3e54f1 SHA-256: d029a9ba7961459cdf6caf7bd0c0f79da065a14c2c7b47de399e29498edac421
12 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution

The sample is a PDF file identified as suspicious due to its relation to CVE-2023-26369, indicating it exploits a known vulnerability. The presence of XFA forms and embedded TrueType fonts further supports this. While the document body is heavily obfuscated and unreadable, the heuristic firings strongly suggest the file is designed to leverage this vulnerability for code execution, likely as a downloader for a secondary payload. No specific malware family was identified.

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoft In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn PDF document text
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In PDF document text
    • http://www.microsoft.com/Typography/0In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00035f16.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x35F16 325424 bytes
SHA-256: 96281417f7381aa8c40f0aa376d60e29334008fa3a19ad6125e9b3e183816f71
stream_017_off00069efb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x69EFB 41741 bytes
SHA-256: 9ed2b93ec90846179b6f153d99bc4556a950117d2c0aaef212d5ed9666a0e729

Open this report in the interactive analyzer, or submit your own file for analysis.