Malicious PDF — malware analysis report

Static analysis result for SHA-256 088e1f20fbb059a0…

MALICIOUS

PDF

11.5 KB Created: 2010-03-27 16:37:14 Authoring application: Datoanwtobowid
MD5: 97d3762e2fcf3fab252338db93fcd5a2 SHA-1: 4cff6a9b323d1eb316431b64d965c14dd027f5e8 SHA-256: 088e1f20fbb059a0a22043f25c136dea8e375ae2652af614281670ed22feb55a
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent. The JavaScript code appears to be obfuscated, but its presence and the nature of the heuristics point towards an exploit designed to execute arbitrary code, likely downloading a further stage. The authoring application 'Datoanwtobowid' is unusual and may be a custom tool.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-20304 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-20304
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0020_000.js
0f3cf34d02b69963027748ef404bd433cf355cadb7dd4189d9ddc0d81aad1363		 pdf-javascript-stream PDF /JS object 20 at offset 0x2713 3713 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.