PDF malware analysis — malicious · d59d34200d572e1b

MALICIOUS

PDF

2.5 KB

MD5: 775d7818b76d83932dded5a2d39ba118 SHA-1: 02d2c144a9f2522cc1ddee5554f87c430dc896db SHA-256: d59d34200d572e1bf949ee00e0d372a756a84a11d35ccc36fccb872fa44ee427

76 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The critical heuristic firing for CVE_2010_0188 indicates that this PDF document is designed to exploit a known vulnerability in Adobe Reader. The XFA form and embedded file further support this finding. The exploit likely leads to the execution of a secondary payload from the embedded artifact.

Heuristics 3

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `a5411600950b1db98118ea358c42cc2748a5720aa10f985f8198536d39a3e99e`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x51	13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.