Malicious PDF — malware analysis report

Static analysis result for SHA-256 02a7a399c3a15805…

MALICIOUS

PDF

8.2 KB
MD5: 96179083d861f9f6f8b9535b6d8b0ef9 SHA-1: 7ac9bc93f3cdf2320f34488cac45ca6384dcb5ec SHA-256: 02a7a399c3a15805121c92ebe5ca6663ec101b9c23c7985c655a59da3e3d870e
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating it is a dropper. Embedded JavaScript was detected, which is likely responsible for downloading and executing a secondary payload. The presence of JavaScript points to the T1059.007 (JavaScript) technique, and the nature of the file suggests it was likely delivered as a spearphishing attachment (T1566.001).

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7222791-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7222791-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.