Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5159df13a28bb67…

MALICIOUS

PDF

1.5 KB
MD5: f41d3343addb725937babd295e3d69d0 SHA-1: bfb66edc7ed011cf6dde613b90febce168560b81 SHA-256: f5159df13a28bb67a8d92f3b45228f8b06e7bbd8813ba18f554258a44e655522
118 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 JavaScript/JScript

The PDF file contains embedded JavaScript, which is triggered by the 'media.newPlayer' object, indicating exploitation of CVE-2009-4324. The JavaScript is obfuscated and likely intended to download and execute a second-stage payload. The presence of multiple JavaScript streams and the unescape() function further support this. The document body is unreadable, but the technical indicators strongly suggest a malicious exploit delivery.

Heuristics 5

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (matched in decompressed stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj111711_000.js
ffe744de31144afeb3266c99242f34e8c1e3fa18cd2563c7c4ff083cf8bc07d7		 pdf-javascript-stream PDF /JS object 111711 at offset 0x197 187 bytes
javascript_obj111712_001.js
3dba3e646af53d578d91da5980b9fef2c41d20b5859572ddc2d510243b91e700		 pdf-javascript-stream PDF /JS object 111712 at offset 0x275 1926 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
javascript_obj111713_002.js
23163343e0372409aa9b9a12d2e098bbeca255cf6f305c2bf1707506326d2c96		 pdf-javascript-stream PDF /JS object 111713 at offset 0x4FC 150 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.