Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8335032fdce2282…

MALICIOUS

PDF

5.5 KB
MD5: fec668f60cd20e8c9c7a4b289e1e2512 SHA-1: a3419d5e71165ae80f7f4bfb306a926334ae9bab SHA-256: d8335032fdce2282ff2b1256f0ed6ab9ff667f9033a9e3e1abda5b63d7ddf373
186 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript and triggers a critical vulnerability (CVE-2014-0496) related to app.addToolButton/removeToolButton, indicating an attempt to execute arbitrary code. The presence of obfuscated JavaScript further supports this. The embedded URLs are related to XFA forms, which are often used in PDF exploits.

Heuristics 8

  • app.addToolButton/removeToolButton — CVE-2014-0496 critical CVE exact CVE_2014_0496
    PDF JavaScript combines app.addToolButton() and app.removeToolButton() with heap-spray shellcode markers — the public Adobe Reader/Acrobat ToolButton use-after-free exploit shape for CVE-2014-0496. (matched in decompressed stream)
  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
5d5953259d1411484a6c19cfd3164eec2a51afa771d303a93a79361637527d02		 pdf-javascript-stream PDF /JS object 5 at offset 0x166 4613 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 13 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.