MALICIOUS
356
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious File
T1059.003 Command and Scripting Interpreter: Windows Command Shell
T1105 Ingress Tool Transfer
The PDF file contains JavaScript that utilizes a launch action to execute cmd.exe. This action is designed to exploit CVE-2010-1240, allowing for command execution. The script also contains a call to 'this.exportDataObject' which, combined with the launch action, indicates an attempt to drop and execute a payload. The embedded URL 'http://www.primopdf.com' is likely related to the document's origin or a lure.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 10
-
Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
-
ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Tool.Agent-1388586
-
Launch action critical PDF_LAUNCHPDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
-
/Launch action target: cmd.exe critical PDF_LAUNCH_COMMANDPDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\Testpdf.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
-
/Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JSPDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
-
PDF embedded file could not be fully decoded medium PDF_EMBEDDED_FILE_UNDECODEDA declared PDF /EmbeddedFile stream uses filters that the scanner could not decode. The raw stream was carved for artifact triage because malformed or unsupported attachment filters can hide payload content from normal extraction.
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.primopdf.com In PDF document text
- http://www.primopdf.com)/Author(newIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0018_000.js |
pdf-javascript-stream | PDF /JS object 18 at offset 0x2E3A | 56 bytes |
SHA-256: c29717061cb4cb04e18982cddf81c2ac3b9c9c06a6dd1fef298ab670bfca07e4 |
|||
Preview scriptFirst 1,000 lines of the extracted script
this.exportDataObject({ cName: "Testpdf", nLaunch: 0 });
|
|||
font_00_sfnt_off000004ce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4CE | 17328 bytes |
SHA-256: 162bec52abd01d487f9b6ad46ff8600e6e712ee6c9d6ce05003d99fd27e70e76 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.