Malicious PDF — malware analysis report

Static analysis result for SHA-256 f24bed945e7eeba4…

MALICIOUS

PDF

112.8 KB
MD5: f185a86b1097b030e9220ecf6688117a SHA-1: ff80de216b7660207f381f688fc5041539c6386b SHA-256: f24bed945e7eeba4a2ec8743e0ae77180747060b407d66c2c449c9df957a8b0a
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF document contains embedded JavaScript that utilizes eval() and unescape() functions, indicating obfuscated malicious code. Critical heuristics confirm the exploitation of CVE-2009-4324 via the media.newPlayer object. A secondary embedded PDF was also found to contain similar suspicious findings. The primary function of the embedded script appears to be the exploitation of this known vulnerability to achieve arbitrary code execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0057_000.js
947a0485838d3a2d2af45c4fcce56c81820cc1995c1099714bb56fb9e05b38b0		 pdf-javascript-stream PDF /JS object 57 at offset 0x551F 2218 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
stream_005_off00000b74.bin
e4217c167299ac63f64b8b7e903cc0196f0828693d273431b8b793a12ed0fed3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB74 1000 bytes
objstm_0053_00.bin
f9797d0fa28384c30d8bf1da89163104ce539753e417fa1f9c5fd135d1eceb39		 pdf-objstm-decoded PDF /ObjStm 53 0 obj (inflated) 50 bytes
polyglot_child_pdf_off00015757.pdf
36d0cbfeadb42b9ee6a05920e8618550cc7baf9ebd37614bdb4c5faad2725d4c		 polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x15757 27598 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.