Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2fa9c253b308be6…

MALICIOUS

PDF

216.9 KB Created: 2009-09-26 07:34:11 +02:00 Authoring application: Writer (via OpenOffice.org 3.0) First seen: 2026-05-11
MD5: c2a694f257d35e07eb558a41c75c4c12 SHA-1: 11749aaa3f24da406e98f87062b6e3fb0fe97778 SHA-256: f2fa9c253b308be613079a9fef88bb3460aefa275986ab7b22822316bdd55201
300 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The PDF file contains embedded JavaScript and a launch action that targets cmd.exe, indicating an attempt to execute arbitrary commands. The critical heuristic CVE_2010_1240 specifically identifies this pattern of exploiting Adobe Reader's launch action to execute cmd.exe with shell parameters and an embedded-file/exportDataObject payload chain. This suggests the file is designed to download and execute a secondary payload, consistent with a malicious dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 7

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "%USERPROFILE%\\����\\ADMPlugin.apl" (cd/D "%USERPROFILE%\\����"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • PDF embedded file could not be fully decoded medium PDF_EMBEDDED_FILE_UNDECODED
    A declared PDF /EmbeddedFile stream uses filters that the scanner could not decode. The raw stream was carved for artifact triage because malformed or unsupported attachment filters can hide payload content from normal extraction.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dejavu.sourceforge.netFonts In extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn extracted file (font_01_sfnt_off00018873.bin)
    • http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlUseIn extracted file (font_03_sfnt_off00023149.bin)
    • http://www.ascendercorp.com/liberation.htmlIn extracted file (font_03_sfnt_off00023149.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00014e11.bin)
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_01_sfnt_off00018873.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ADMPlugin.apl pdf-embedded-file-undecodable PDF EmbeddedFile object 109 at offset 0x35BFD; filter decode failed 479 bytes
SHA-256: 5f652b4721b3d1b90ddd52861e916b227a7afb13f2058f5e5820f0de19b6d7cc
javascript_obj0110_000.js pdf-javascript-stream PDF /JS object 110 at offset 0x35DEF 58 bytes
SHA-256: 0fedc506516bc0750b9540d66ff6d1bbd092eaaa9476e8e79aeda20b80c4f9aa
Preview script
First 1,000 lines of the extracted script
this.               t({ cName: "ADMPlugin", nLaunch: 0 });
font_00_sfnt_off00014e11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E11 22612 bytes
SHA-256: 36dfa1c87891f2f09b71980d1399f018c5caad03d1b1d29508739979b9ed4001
font_01_sfnt_off00018873.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18873 39760 bytes
SHA-256: f027842567b04c926ad746e8dfdc4f8cdd2e3c7e0220264a22bb516569de8c36
font_02_sfnt_off0001e18a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E18A 33672 bytes
SHA-256: da753cc0b5163c9b6666572dbeb35b7b5caf4a56d9c22c99c36835925c000a71
font_03_sfnt_off00023149.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23149 12752 bytes
SHA-256: 23ac8feb518c8c727acc6a954bb623e333337c9458521aed483fcc8d89f418c1
font_04_sfnt_off0002558e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2558E 13136 bytes
SHA-256: c8fd7189737c38a43b9ba034337799f502028b5db5a6037bd1df4c486f3233e0
font_05_sfnt_off00027bf4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27BF4 27096 bytes
SHA-256: cf699c117fd0bb7368c625645b874f03c477a382b67075e98dd54d87de53958b
font_06_sfnt_off0002ca67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA67 13700 bytes
SHA-256: 34829650519fe758a893e02057f5c7c1070378add027225386180ba60993be24
font_07_sfnt_off0002f2cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F2CF 14892 bytes
SHA-256: bf36ecd37d117b665b1c68abb1c41fbb1a9d46c2c583bdb8512681835e553b91
font_08_sfnt_off00031db2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31DB2 13576 bytes
SHA-256: 37478039963094b7b89fb24df19adb1f5ee171f766ade680ac5516bb23ede59f
font_09_sfnt_off00033c21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33C21 1780 bytes
SHA-256: df903f2017d43426972294ce96b065da76255f4a0de84e466c7a4dd6181632c2

Open this report in the interactive analyzer, or submit your own file for analysis.