PDF malware analysis — malicious · dab586508229c920

MALICIOUS

PDF

3.9 KB

MD5: 65b19cc0506c5a0a225a3009572899cb SHA-1: 98b6f0f38a13c58ae302520b2b1d14f1def3a18b SHA-256: dab586508229c920c6ec2a4fd0f33ad5df35f6a73eaf9ef0a3dbf1dc9cb1a177

184 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript that leverages the CVE-2014-0496 vulnerability by using app.addToolButton/removeToolButton with a numeric char-code string. This JavaScript is further deobfuscated and contains eval() calls and String.fromCharCode, indicating it's designed to download and execute a secondary payload. The extracted artifacts include deobfuscated JavaScript files, reinforcing the malicious intent.

Heuristics 7

app.addToolButton/removeToolButton — CVE-2014-0496 critical CVE exact CVE_2014_0496

PDF JavaScript combines app.addToolButton() and app.removeToolButton() with heap-spray shellcode markers — the public Adobe Reader/Acrobat ToolButton use-after-free exploit shape for CVE-2014-0496. (identified after JavaScript deobfuscation)
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
String.fromCharCode medium PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `75e84e8267606ab65ba38934e0cf94ddbf5104dc86c5c7a31a7359a4204e5d57`	pdf-javascript-stream	PDF /JS object 6 at offset 0x224	19524 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`stream_000_off0000012f.bin` `69d0d0114b03e3f7748b6bbd5809c83dc8d156e20d1bfcdf9d5925fb9a502f54`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x12F	372 bytes
`numeric_charcode_stage_000.js` `e15fdb086a77c1a2874c1358d51ff2c54c84111f6f1e6843d0628980ae42a938`	deobfuscated-js	numeric char-code string decoded JavaScript at offset 0x232	5778 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 15 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.