PDF malware analysis — malicious · 0912898105816c5d

MALICIOUS

PDF

30.6 KB Created: 2010-02-20 19:30:23 +03:00 Authoring application: firstDuring (via 16cba01e083801067db052ea5cfd254c)

MD5: 70c02964c27aa47e31555005023e4a79 SHA-1: 272062572245a5a2af628f4c6e7c63ac5463460b SHA-256: 0912898105816c5db83e754e8a0eb0e9727949698ef5acbc7e8d4c76c7f5f4f2

134 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is a PDF containing multiple embedded JavaScript streams, flagged by heuristics as malicious and identified by ClamAV as 'Pdf.Dropper.Agent-7226227-0'. The JavaScript is heavily obfuscated but its presence and the PDF structure strongly indicate an attempt to exploit a vulnerability for client execution, likely as a spearphishing attachment. The primary function appears to be downloading and executing a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 5

ClamAV: Pdf.Dropper.Agent-7226227-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7226227-0
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0016_000.js` `82f05da69fb0a1d34fadd8f19e444e0faf7bcbd5734b7bc29e7b2ebf03ae9a26`	pdf-javascript-stream	PDF /JS object 16 at offset 0x1FC2	2993 bytes
`javascript_obj0018_001.js` `3f3ee321c7b96ddff49afbc8198ce8d8ef15088dea910d58248f49e1adbac5eb`	pdf-javascript-stream	PDF /JS object 18 at offset 0x2940	35579 bytes
`javascript_obj0020_002.js` `6c59bb9b96065b8cbca5774768b67a9151f004d1f3370905811354754f33db11`	pdf-javascript-stream	PDF /JS object 20 at offset 0x7428	120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.