PDF malware analysis — malicious · f5b9e332bc42d972

MALICIOUS

PDF

123.6 KB

MD5: 098b6822902ee29ee14c3e1a9359bb11 SHA-1: 9432f01028f0f60219984c9418b64ab4044598ba SHA-256: f5b9e332bc42d97202713401e3cf1430800c3474899c7e231c193b88898739ec

154 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded JavaScript and RichMedia content, triggering critical heuristics for CVE-2011-2462. The embedded JavaScript stream (javascript_obj0029_000.js) is likely responsible for executing the exploit. The presence of multiple JavaScript streams and a SWF file suggests a multi-stage attack designed to compromise the user's system.

Heuristics 8

Adobe Reader U3D/RichMedia parser exploit critical CVE likely CVE_2011_2462_RICHMEDIA_U3D

PDF combines U3D stream markers with RichMedia and JavaScript/XFA activation surfaces. This is the U3D RichMedia exploit document shape associated with CVE-2011-2462, even though the U3D marker is not exposed through the canonical /Subtype /U3D dictionary.
RichMedia (Flash) high PDF_RICHMEDIA

PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`5.swf` `797559d3f1e4f62f7d7ec5a729b60c863e13118d22afb32eab08faf38dc7c87f`	pdf-embedded-file	PDF EmbeddedFile object 50 at offset 0x40C5	2809 bytes
`javascript_obj0029_000.js` `1cabdf911c799c7d403bcd3add554d5c8545aa96e0e98435019f71581269fe5a`	pdf-javascript-stream	PDF /JS object 29 at offset 0x1CA99	19788 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`javascript_obj0039_001.js` `79a847f48c29830c80cf0408c7505d8bd07472b58ec4ea49698a533638d7bb04`	pdf-javascript-stream	PDF /JS object 39 at offset 0x1E9B	5637 bytes
`javascript_obj0056_002.js` `2b0cb364300292a88607c7b04076629077f1b58bbf9fa93686a58f4ad62ef40b`	pdf-javascript-stream	PDF /JS object 56 at offset 0x32FA	1417 bytes
`stream_004_off0000088f.bin` `69e17a0038b9273e6d005ef52313a832cb41b9cf9713d6134d0cf9f2e59298a7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x88F	434 bytes
`font_00_sfnt_off00000e51.bin` `9520d1e3c26c38a7d8e0587578a21196782149e3c5f4b565229deafde3ff3a35`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE51	8429 bytes
`font_01_sfnt_off00001663.bin` `18f2d21f655a09be0df9f6bfb4b539e43160f5a64a3e1b2dd7a4c8a5a185a5d2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1663	8429 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.