Malicious PDF — malware analysis report

Heuristics 6

• TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
  PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
• ClamAV: Pdf.Dropper.Agent-7329038-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Dropper.Agent-7329038-0
• PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
  PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://rgadmission.com/sam/img/img/index.php In PDF document text

  • http://holidaycoasttours.com.au/css/js/web/new%20pdf/pdf.htmlIn PDF document text
  • http://sonsuzumol.com/admin/oder%20pur/Newpdf/login.htmIn PDF document text
  • http://hateau.ga/wp-content/site/payment/pvbt9ibsd66s0oldonxo3vug.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1In PDF document text
  • http://berhfer.co/templates/order/adobe/index.phpIn PDF document text
  • http://www.radpdf.comIn PDF document text
  • http://����������������������.����/godrive/purchaseorderIn PDF document text
  • http://almansurtravels.com/fft/adobeIn PDF document text
  • http://www.radpdf.com)/Author(user)/Creator(RADIn PDF document text
  • http://www.dynaforms.comIn PDF document text
  • http://фоторемесло.рф/godrive/purchaseorderPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouReferenced by PDF JavaScript
  • http://www.microsoft.com/typography/fonts/default.aspxReferenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0Referenced by PDF JavaScript
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
  • http://www.microsoft.com/Typography/0Referenced by PDF JavaScript
  • http://www.microsoft.com/typography/ctfontshttpReferenced by PDF JavaScript
  • http://www.microsoft.com/typographyReferenced by PDF JavaScript

Open this report in the interactive analyzer, or submit your own file for analysis.