Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7542da50e558356…

MALICIOUS

PDF

128.8 KB Created: 2010-02-18 19:46:19 Authoring application: Microsoft Word (via DocuCom PDF Driver 6.20 for NT)
MD5: 1b246bacfa97a7bb9787f24ccc915181 SHA-1: 1f3fe5356dc3c6818b21aa9d455163270f019b28 SHA-256: e7542da50e55835628677c1e8ac48a54d4829bf922885b7734337c7bcf584316
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1566.002 Spearphishing Attachment

This PDF file contains embedded JavaScript that is obfuscated and utilizes the unescape() function, indicating malicious intent. The critical heuristic firing for CVE-2009-4324 confirms the exploitation of a known Adobe Reader vulnerability. The presence of a secondary embedded PDF further suggests a multi-stage attack. The primary goal appears to be the execution of arbitrary code via the exploit.

Heuristics 8

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • ClamAV: Pdf.Exploit.Agent-18624 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-18624
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000063a.js
365d763fbb0f65e19b96e386dc4061ef4779ace696f86f8e6215f51272edc94a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x63A 2578 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long hex-escaped blob(s).
legacy_pdfkit_stage_000.js
42c3f4df375ff6f58ff655cc4f88b5cc28f0dd33b978390db3538684a6219b74		 deobfuscated-js string-concatenation normalized Acrobat API aliases at offset 0x63A 126 bytes
objstm_0023_00.bin
e8bfe65c34a535b0837ce7c541e45b42ab61e1ff13de05788daf7770f9a1ec0e		 pdf-objstm-decoded PDF /ObjStm 23 0 obj (inflated) 274 bytes
font_00_sfnt_off0000a96f.bin
2db73268554e73307786b28d47aaf966dd4177bc6b12a7c6f5ff08e63887d1df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA96F 224900 bytes
polyglot_child_pdf_off000093db.pdf
cabacae275d993ed3a4d07cc0e40d86b79ad15082aa19f9be178731b3f099e4e		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x93DB 94050 bytes
polyglot_child_pdf_off0001eb50.pdf
0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x1EB50 6125 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.