PDF malware analysis — malicious · eb051ddc21c47184

MALICIOUS

PDF

3.0 KB

MD5: bcfc61cff58b3a1b9e41f04c54fbddf9 SHA-1: d4766b6069e62573a26bae5f5f81011cfec76542 SHA-256: eb051ddc21c47184497056c296a4ecb9eacbcff9483419b662ff22d4b3dad75f

136 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious File

The PDF file contains embedded content and triggers a critical heuristic for CVE-2010-0188, indicating an exploit targeting Adobe Reader's LibTIFF component. The XFA form structure and obfuscated object names further suggest malicious intent. The embedded artifact is likely the payload delivered by the exploit.

Heuristics 4

Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188

PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `6f650976015c923081e7d15ea6414c797a0aaf452d76bc5d630192af9cc79744`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x80	13601 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.