PDF malware analysis — malicious · 012ef42db0270a5a

MALICIOUS

PDF

15.2 KB Created: 2010-03-19 20:57:57 Authoring application: Mecitaneueq

MD5: 1dd08cf849277f10cc588718c137e77b SHA-1: fbbeebf5d6c6c28471584c7eff45f45cd1b63a41 SHA-256: 012ef42db0270a5a5ea9eabc343a963d526d77348524c5b7227af549fb6f2a09

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains embedded JavaScript, flagged by multiple heuristics as malicious. ClamAV specifically identifies it as 'Pdf.Exploit.Agent-30017'. The JavaScript is likely responsible for downloading and executing a secondary malicious payload, a common technique for initial access.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Agent-30017 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-30017
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0020_000.js` `7466db5aa9586245f01263a7d3225aeb0691c0484adc9f66313fdad773b49e7c`	pdf-javascript-stream	PDF /JS object 20 at offset 0x26B9	2541878 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.