PDF malware analysis — malicious · 00fbb34e4685048c

MALICIOUS

PDF

6.7 KB Created: 2010-09-01 09:19:50 Authoring application: Coqilzd (via ae64dVezipovade)

MD5: 076be817235954282db3d1b3e81f215a SHA-1: 39e0e378ffb3155c769e8bc4851b4575ef59e856 SHA-256: 00fbb34e4685048ca95273d4204262c470d9ac5760b4e62e08bba70980331f98

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1204.002 Malicious File

The PDF contains embedded JavaScript that is heavily obfuscated. The script attempts to decode a payload and execute it, likely to download and run a second-stage malicious file. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9925

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `079179f2b5d2111982b6d25d3e16180f95f8876fd2c529b41f4158f5012771c5`	pdf-javascript-stream	PDF /JS object 11 at offset 0x121D	1942 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.