Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddfa192064b7be32…

MALICIOUS

PDF

2.5 KB
MD5: 7de59f793c4d6a0ac14651b44713f799 SHA-1: 8148a9847a5613e154805996db4972b5afab2743 SHA-256: ddfa192064b7be3235bafee2348c2c6e4452ff188bbbafd94483229e229b71b2
76 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a PDF document that exploits the CVE-2010-0188 vulnerability in Adobe Reader's LibTIFF component. This vulnerability allows for arbitrary code execution when a user opens a specially crafted PDF file. The critical heuristic firing directly indicates this exploit.

Heuristics 3

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
e42035ecaef611c938baa615ce2d98f88ddd00ea3c79c93ab941734ddf4434c5		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x51 13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.