Malicious PDF / .__T — malware analysis report

Static analysis result for SHA-256 054eba2691582e33…

MALICIOUS

PDF / .__T

1.95 MB
MD5: 54b176aef5f3218878963f42b37aac6e SHA-1: 8b5d014d627d9f0129141b07958004cb6f7bf95a SHA-256: 054eba2691582e339c8a3f61275ad903b391fcb6ebebad14f55b4ee166a4e5a0
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded JavaScript is likely designed to execute malicious code upon opening the document, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.