PDF malware analysis — malicious · d81b36fc8c127298

MALICIOUS

PDF

483.1 KB

MD5: cea37596242b8af16e43ea2b66eb46ed SHA-1: e0699d84391ad619d887ecf2a717b2c0ae071b09 SHA-256: d81b36fc8c12729806aa4b80e5df1dbfc4a645ddbd8b8d8bb4f4c2242a69d080

214 Risk Score

Malware Insights

MITRE ATT&CK

T1190 Exploit Public-Facing Application

The PDF file contains critical findings indicating exploitation of CVE-2010-2883, a vulnerability in Adobe Reader related to font parsing. It also contains embedded JavaScript streams and a secondary embedded PDF, both of which exhibit suspicious static findings including JavaScript actions, unescape calls, and hex decoding. The primary function appears to be leveraging the exploit to run malicious JavaScript, likely for further stages of infection.

Heuristics 10

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
AcroForm button with action trigger low PDF_ACROFORM_BUTTON

PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xfa/promoted-desc/
- http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/
- http://www.xfa.org/schema/xfa-locale-set/2.7/
- http://www.xfa.org/schema/xfa-locale-set/2.6/
- http://www.xfa.org/schema/xfa-form/2.8/
- http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0026_000.js` `2f574ea0a0abb643798c6edf545b9a2510056a799ef48c2f415cee8e337043b2`	pdf-javascript-stream	PDF /JS object 26 at offset 0x47BF	9909 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`font_00_sfnt_off000149fa.bin` `422bc5698ba5d9d4818f6a2d8b3abca2f723e713b44a15c390139d2c976a1388`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x149FA	65932 bytes
`font_01_sfnt_off0001e85c.bin` `7e24ee16c8b09ee74d61445f29c3c0a95abfdf17fc1008606394f159dbd0c106`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1E85C	65932 bytes
`font_02_sfnt_off000286ba.bin` `57e24925bc6bdb98d38e8b4ba3b87f80f75c5e49ea9a522486790d7dc6848549`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x286BA	65932 bytes
`font_03_sfnt_off000324e1.bin` `1f068d668b316fcb46f0801be00137fb749cc7fda5ca15e442829d6c303d8f99`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x324E1	65932 bytes
`javascript_obj0026_000_1.js` `069a89b6f2f078afb16f916d86d3b6eba90828dc6a12c7c5f1d504af9e72d295`	pdf-javascript-stream	PDF /JS object 26 at offset 0x47BF	7423 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`javascript_obj0026_001.js` `8d4057219fac943f1d05b245fc2986eb457d8f5b8516eaf8357f073b44d11b0e`	pdf-javascript-stream	PDF /JS object 26 at offset 0x47BF	2265 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`polyglot_child_pdf_off0003ca8f.pdf` `06e83b0ae9e504d817082433d99389dbbd85464553cb8fefd3acd9c8f35d5c10`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x3CA8F	246222 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 10 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.