PDF malware analysis — malicious · 05305ce0c093244f

MALICIOUS

PDF

14.5 KB Created: 2009-11-15 19:41:70 Authoring application: PDF Library 4.3.9 (via PDF Library 3.9.7)

MD5: b958a4bf81c829fb543df472015ccebf SHA-1: 97bec45bea5a8d11d5a4443752ce446a757ce2f5 SHA-256: 05305ce0c093244f2b2014e5fd751aa2695ca82f5562b3ccee68e3b9afa2225d

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is a PDF file flagged as malicious by multiple engines, including ClamAV which identified it as Win.Trojan.Agent-36166. It contains embedded JavaScript, indicating an attempt to execute code when the PDF is opened. The JavaScript appears to be obfuscated, but its presence and the ML classifier's high confidence suggest it's designed to exploit a vulnerability for client execution, likely delivered via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Win.Trojan.Agent-36166 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Agent-36166
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `54fc84e2d154ab405955d29c473f915fcdb000e3419929eb4f83549be280f7ab`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	74824 bytes
Detection ClamAV: Win.Trojan.Agent-36166 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.