MALICIOUS
84
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: Malicious File
The PDF file contains embedded JavaScript that utilizes the String.fromCharCode method and exploits CVE-2009-4324 via the media.newPlayer object. This indicates the document is designed to execute arbitrary code upon opening. The JavaScript is obfuscated, but the exploit targeting is clear. No specific family could be identified.
Heuristics 4
-
media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
String.fromCharCode low PDF_FROMCHARCODEString.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules.
Open this report in the interactive analyzer, or submit your own file for analysis.