PDF malware analysis — malicious · 059c40b396b45315

MALICIOUS

PDF

3.2 KB

MD5: 6d98a42576ac14209de4d224b6a447c8 SHA-1: 8a22c323f430c3713b65cc157936bfdcf64034a4 SHA-256: 059c40b396b453154e3baf6f8ce82882ff33fe1dae6f3a9c33c1e42ccc8a2491

206 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes the unescape function, a common indicator of PDF exploits. The script appears to be designed to download and execute a secondary payload, as suggested by the heuristic firings related to JavaScript exploits and the ML classifier. The ClamAV detection further confirms its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 5

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `bef1c7b7c5251e59a1fee2018a7e4a6b027b0af795370c3749850c47e733940a`	pdf-javascript-stream	PDF /JS object 7 at offset 0x9C5	504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.