Malicious PDF — malware analysis report

Static analysis result for SHA-256 085d65fb647e3166…

MALICIOUS

PDF

28.0 KB
MD5: e64431acce49d036af5ed05f5f9df4f5 SHA-1: 2143f03a7a8aa1900fe9bdeb383da0a3df1b0f07 SHA-256: 085d65fb647e3166a0da91797498db1dbd3b2b24334aec5b675e7c6a3fae8b12
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple detection engines, including ClamAV, as malicious due to embedded JavaScript. The presence of XFA form elements and an embedded URL further supports the likelihood of an exploit targeting PDF viewers. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Js.Exploit.HTML-30 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Js.Exploit.HTML-30
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.xfa.org/schema/xfa-template/2.5/

Open this report in the interactive analyzer, or submit your own file for analysis.