PDF malware analysis — malicious · e4a5fa67c2189cd4

MALICIOUS

PDF

138.2 KB

MD5: 5f0806cea353a45ec69ac103fad260c2 SHA-1: be60128c0e9940343a483f2d72d21612574be0ff SHA-256: e4a5fa67c2189cd43b8991564bd733749f2683af9ba8e90737228c23535e1f54

136 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The critical heuristic firing for CVE-2010-0188 indicates that this PDF document exploits a known vulnerability in Adobe Reader. The embedded file and obfuscated object name further suggest malicious intent. The primary attack vector is likely the exploitation of this vulnerability to achieve arbitrary code execution, which would typically be used to download and execute a secondary payload.

Heuristics 4

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `f250dac41c2ad36fa3ff18dd4451c5fcaab265c5b2cf5bc5356a1054bf5f0b1b`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x51	13711 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.