Malicious PDF — malware analysis report

Static analysis result for SHA-256 07bfab64c9e8085f…

MALICIOUS

PDF

132.7 KB
MD5: 8de70ec142099e5019c1554da1205bc9 SHA-1: 2912d07a9bd7e2abad28fb9a838f5d2debb9acc0 SHA-256: 07bfab64c9e8085f3e29957430607d48c6ae339143f3dde508fa23bc0a31f97f
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and ClamAV. The JavaScript appears to be obfuscated but is designed to download and execute a secondary payload, as indicated by the ClamAV detection on an extracted JavaScript artifact. This suggests a multi-stage attack, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36388 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36388
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
c85102c22c38a08ac718b497e6c327da030200f0731a7f3f1165331524b0612a		 pdf-javascript-stream PDF /JS object 76 at offset 0x2C2 119526 bytes
Detection
ClamAV: Js.Exploit.HTML-27
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.