Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b93e3046dd166cc…

MALICIOUS

PDF

44.7 KB
MD5: 92bf72c7605ab952e357a56cc8a348f6 SHA-1: 20efbff6ee938f0cf76058d8a255de55383d5cf3 SHA-256: 0b93e3046dd166ccb2bc92a3fd2f318e55e11dddd4e084777d6236fee0642d30
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript streams, flagged by multiple heuristics as malicious and triggering a high ML score. The ClamAV detection 'Pdf.Exploit.Agent-36128' further confirms its malicious nature. The JavaScript appears to be designed to exploit a vulnerability and execute code, likely downloading a second-stage payload. The presence of JavaScript indicates the T1059.007 (JavaScript) technique. Given it's a PDF, T1566.001 (Spearphishing Attachment) is a likely initial access vector, and T1203 (Exploitation for Client Execution) is relevant due to the exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
ad9028f081071aa811565a05e645efca3b2b4ca1c927b72b45768a64da439227		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 44969 bytes
javascript_obj0008_001.js
9de164fcac8aab0df8f489957f00d4f8ca5cc43a47f36cb9a970b26bc9a08518		 pdf-javascript-stream PDF /JS object 8 at offset 0x20A 45219 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36128
Obfuscation or payload: unlikely
legacy_pdfkit_stage_000.js
2e668e50d7973d94790e3a8cb28776de6be20e06a9cfe9bdc23a3a375f05dec8		 deobfuscated-js double percent-decoded annotation JavaScript at offset 0x1E7 32807 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.