PDF malware analysis — malicious · d9493b6243a03788

MALICIOUS

PDF

101.5 KB

MD5: 8e633588b3ee59de09fe126d99869d2d SHA-1: 57363d0011cde51d4aaf229f1b1c2808bad9a8cf SHA-256: d9493b6243a0378859610748590de21dc4df36c287197fde13c507d3895f8be6

106 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript and triggers the CVE-2010-2883 exploit for Adobe Reader. The JavaScript stream, although partially obfuscated, is indicative of a downloader or initial execution stage. The presence of the exploit and JavaScript strongly suggests an attempt to compromise the user's system by executing arbitrary code.

Heuristics 6

Adobe Reader CoolType SING font exploit — CVE-2010-2883 critical CVE likely CVE_2010_2883

PDF embeds a TrueType/OpenType font with an actual SING table and pairs it with JavaScript heap-spray shellcode. This matches the public Adobe Reader CoolType SING exploit shape for CVE-2010-2883.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0038_000.js` `2c0b66ec50073178ddc3de2aaf0627ef83819a8f71c118ff3b075b4bd82749fe`	pdf-javascript-stream	PDF /JS object 38 at offset 0x1B82	1242 bytes
`javascript_obj0040_001.js` `babf9a220771b8d6a22eb35d52dc8736bd8ef2552f01a2076eb072c75a71b0ca`	pdf-javascript-stream	PDF /JS object 40 at offset 0x181FE	15084 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 long base64-like blob(s).
`stream_004_off00000b11.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB11	434 bytes
`font_00_sfnt_off00001152.bin` `fc85f44193ccd402987935418c4f5fdf6802c96450b789e7fce04f9791933021`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1152	7965 bytes
`font_01_sfnt_off00001903.bin` `1e827515a464087cdace63e3578c118b45a657ed40cdbb9de7eead35c9b593ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1903	7965 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.