PDF malware analysis — malicious · ef84048802f38158

MALICIOUS

PDF

2.3 KB

MD5: 8f425dfe34e7053b2821dcbe60445570 SHA-1: 838fae2425d9f0a0dc47f33dcd372e4badf13f6b SHA-256: ef84048802f38158601a5a12c325c64615893d7af7459a02fee1001487a26a39

118 Risk Score

Malware Insights

MITRE ATT&CK

T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains embedded JavaScript, which is triggered by a CVE-2008-2992 exploit. The JavaScript is heavily obfuscated, but the presence of `unescape()` and `util.printf` calls strongly suggests it's designed to download and execute a second-stage payload. The extracted file `javascript_obj263984_000.js` is also a suspicious artifact.

Heuristics 5

util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj263984_000.js` `41977db3b25d610ae6a6b71d344578100ff342e5a16c96304550d1b252caccd4`	pdf-javascript-stream	PDF /JS object 263984 at offset 0x197	7068 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 3 long base64-like blob(s).
`javascript_obj263985_001.js` `ac80ab1db6db5227811d0f360b998a117d910380a6d8c2196faedda1250576a3`	pdf-javascript-stream	PDF /JS object 263985 at offset 0x6DC	155 bytes
`javascript_obj263986_002.js` `9c347ee4f89f89b5e9286bd7438bc046fa7582214c394a39df8aba38a2c3ea8b`	pdf-javascript-stream	PDF /JS object 263986 at offset 0x7AD	512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.