Malicious PDF — malware analysis report

Static analysis result for SHA-256 f62d01827e3504a3…

MALICIOUS

PDF

1.07 MB Created: 2008-02-19 15:01:00 +01:00 Authoring application: Adobe Designer 7.0 First seen: 2026-05-08
MD5: 6bec54ef5876cdab33c467e2f348b26f SHA-1: c9e23d89ba57110979dbaeadeb8f398f18f83fe1 SHA-256: f62d01827e3504a37ee6628999bb75370b2e342de9ec0f2c03cbceb958bfa44a
136 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1204.002 Malicious File: User Execution: Malicious Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains embedded JavaScript and is flagged for exploiting CVE-2010-0188, a vulnerability in Adobe Reader related to XFA forms. This indicates the document is designed to deliver a malicious payload upon opening. No specific malware family was identified, but the exploit suggests a targeted attack or a widely distributed exploit document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9517

Heuristics 9

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded script payload in PDF stream info PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://ns.adobe.com/xdp/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xci/1.0/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.2/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.1/Referenced by PDF JavaScript
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xtd/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0822.bin pdf-embedded-file PDF EmbeddedFile object 822 at offset 0xCD97D 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0823.bin pdf-embedded-file PDF EmbeddedFile object 823 at offset 0xCDA30 2286 bytes
SHA-256: 72fb19c4f1433a29eb816fa2643b0fda2801e58bb4de3d6c6a7d530563da8bac
embedded_file_obj0824.bin pdf-embedded-file PDF EmbeddedFile object 824 at offset 0xCDDC9 323584 bytes
SHA-256: e94599090058f658d1782e8fa0f6a1ea9eb231b29202ac26f117a53609537db0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
815 of 1549 identifiers look randomly generated (e.g. 'KCeGMfEa8r6CEJWY5tmSEBujtHgkxzNCHKIRkNQ1'); 24 string-concatenation chain(s) — consistent with name-mangling obfuscation.
embedded_file_obj0825.bin pdf-embedded-file PDF EmbeddedFile object 825 at offset 0xEF60E 3070 bytes
SHA-256: c111ab7ed08efa2f582b38e24dd8e7af547a1cabc5012f0ed20fb43a368dabc5
embedded_file_obj0826.bin pdf-embedded-file PDF EmbeddedFile object 826 at offset 0xEF89F 212 bytes
SHA-256: 57045217c453d4674a08ad8778674bf199a7989a9505424a1815c016e6bb412f
embedded_file_obj0827.bin pdf-embedded-file PDF EmbeddedFile object 827 at offset 0xEF997 724 bytes
SHA-256: b5c80aaca30b5ad1a78f82136b95d90b2b5bd955322f2292dd939f9e53766f15
embedded_file_obj0828.bin pdf-embedded-file PDF EmbeddedFile object 828 at offset 0xEFB7A 85 bytes
SHA-256: a60265344cf1a9e94da34c8f587f64a4297e2fa417c895852209903ab7588bcc
javascript_obj0814_000.js pdf-javascript-stream PDF /JS object 814 at offset 0xCD1F6 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0816_001.js pdf-javascript-stream PDF /JS object 816 at offset 0xCD37D 2794 bytes
SHA-256: 4e139c8b22ec16bd5aa51575c80dec2bbf89b76977a06b68473031a0eb206366
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0818_002.js pdf-javascript-stream PDF /JS object 818 at offset 0xCD66F 1528 bytes
SHA-256: c876171bd867b66b7671fb337ff9e57d18cd15b43d344cf5a7243821300a408a
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.0)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
xfa_image_rawvalue_000.tif pdf-xfa-image-tiff XFA image/rawValue TIFF payload near offset 0xDDF59 28166 bytes
SHA-256: 1d11b2659e28059a04a324f9808af7c1848af29bdbac83c43057b95c6a8ccc4f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.86, consistent with packed or encrypted content.
stream_006_off00002f92.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F92 308015 bytes
SHA-256: 4735e29f6b4dfaae31ceba3a66c7548a579b3b0ad8f9ec68bc6e90b0597d7de3
stream_014_off0006adea.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6ADEA 222774 bytes
SHA-256: 64082d40d3cdc1067fa248dd1ffcfce08f00554bd2adca2ed59375761244c428
stream_038_off000efc90.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEFC90 505386 bytes
SHA-256: 0729704c7e8dc2680aa8450eb31b84c01d79d5aa49fde8bdf24dfaacc6e51a3d

Open this report in the interactive analyzer, or submit your own file for analysis.