Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe95cdbb84d704c9…

MALICIOUS

PDF

2.5 KB
MD5: 7905986bfb8cce89bf6753d5d24b1699 SHA-1: 5bbe14a6c9aa4cd7dd72a347254b9592055e142f SHA-256: fe95cdbb84d704c91f657b5c28d5958f8e6584f58651f3bc52c461fe0bfa8254
76 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.001 Malicious Link: Malicious Link T1204.002 Malicious Link: Clickjacking

The PDF file contains an embedded XFA form that triggers the CVE-2010-0188 exploit. This vulnerability in Adobe Reader's LibTIFF processing allows for the execution of arbitrary code. The embedded artifact suggests the delivery of a secondary payload.

Heuristics 3

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
bea32f71991a0b93371122fda7abdfc184c12c3854c36fb8f5947cae104702c4		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x51 13581 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.