MALICIOUS
368
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.003 Windows Command Shell
T1071.001 Web Protocols
The PDF file contains embedded JavaScript and a launch action that targets cmd.exe, indicating an attempt to execute arbitrary commands. The critical heuristic CVE_2010_1240 confirms this, specifically noting the launch action with shell parameters and an embedded payload. This suggests the document is designed to exploit a vulnerability to download and execute a second-stage payload.
Heuristics 10
-
Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
-
TrueType bitmap font + active content — CVE-2023-26369 related high PDF_CVE_2023_26369_RELATEDPDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
Embedded Windows executable payload in PDF stream critical PDF_EMBEDDED_PE_PAYLOADPDF stream bytes contain an embedded Windows executable with a verified PE header. Exploit chains often hide droppers inside ordinary streams rather than standard /EmbeddedFile attachments.
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\original.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
-
ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Tool.Agent-1388586
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0341_000.js984dc947e3990b672a0fd08a6d6a748764f8ebb7e4ccd5dd4103b775a13e0e89 |
pdf-javascript-stream | PDF /JS object 341 at offset 0x120FA7 | 57 bytes |
stream_048_off000a6e66.bin49167ec59566ad0c4ce724558357f7a21093dd9fe04526e67c3cb0bb56158546 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA6E66 | 138316 bytes |
stream_050_off000c3c33.binff496edba2e4f2b31a251379d48591a214f2dab58955af2f5cdca4a325a83ff8 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xC3C33 | 110336 bytes |
stream_052_off000cfc75.bind550b9a2f7dba00e938834c9a9f744a9b3960b847eb2ac504668188669b181d6 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xCFC75 | 87648 bytes |
stream_064_off001057f4.binb2655fd1615a4939d0584d15349caaef7ad3e4cb402b1d650855bda4dde58188 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1057F4 | 462313 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.