PDF malware analysis — malicious · f5ec827fe6fc3ef8

MALICIOUS

PDF

17.0 KB Created: 2010-01-01 07:27:45 Authoring application: Fexaxououazobb

MD5: ceab9f377cc518ca7cb55cd5a0d36f66 SHA-1: c100e937fa21428c5044a00b83af42c37f206185 SHA-256: f5ec827fe6fc3ef8a26d967711d3836e16a142946f571f1af7587dddc65a8391

318 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution: Malicious Script T1059.001 Command and Scripting Interpreter: JavaScript T1059.003 Command and Scripting Interpreter: Windows Command Shell T1059.007 Command and Scripting Interpreter: JavaScript/JScript

Multiple critical heuristics indicate exploitation of CVE-2009-4324, CVE-2009-0927, and CVE-2007-5659 within the PDF structure. These vulnerabilities are leveraged to execute embedded JavaScript. The extracted JavaScript artifacts, particularly the deobfuscated 'legacy_pdfkit_stage_000.js', suggest the script's purpose is to download and execute a second-stage payload, as indicated by ClamAV detections on extracted artifacts. The file is identified as a dropper by ClamAV.

Heuristics 8

media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324

PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
ClamAV: Pdf.Dropper.Agent-7324476-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7324476-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `7459196d9c3a6a1e58dd9bd3f525998ffa129f48e8133f3610519c92a0c56dda`	pdf-javascript-stream	PDF /JS object 12 at offset 0x4A8	2197 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
`javascript_obj0028_001.js` `c71528464fbfed62bbd747b8a6f666f4b349b717b32f276f7999c036cfe19c98`	pdf-javascript-stream	PDF /JS object 28 at offset 0x1B9	1489 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s).
`legacy_pdfkit_stage_000.js` `483aedf69fd48137fdc7ea08232f559101bfecaf873115ca8b71be092c540a3c`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x7EC	29875 bytes
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 97 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.