Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bf77f8420aca050…

MALICIOUS

PDF

747.0 KB Authoring application: Viraciregavi
MD5: c1d602f423d4c7bbd757edc4f97ce180 SHA-1: eba6d6fc194527b46a49a761ebe7624c19b95686 SHA-256: 0bf77f8420aca0505f84877fce964a2a4facd5675858d5a6bb83146e9646c5b3
110 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The ML classifier and ClamAV detection strongly suggest malicious intent, with ClamAV specifically identifying it as 'Pdf.Tool.HeapSprayHeuristic-6301967-1'. The embedded JavaScript is likely used to exploit a vulnerability and execute a malicious payload, a common technique for PDF-based malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9745

Heuristics 5

  • ClamAV: Pdf.Tool.HeapSprayHeuristic-6301967-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.HeapSprayHeuristic-6301967-1
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/t/pg/
    • http://ns.adobe.com/xap/1.0/g/img/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/rights/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xmp/InDesign/private
    • http://ns.adobe.com/pdf/1.3/
    • http://www.iec.ch

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off0001ef9a.icc
2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e		 pdf-icc-profile PDF ICC profile at offset 0x1EF9A 3144 bytes
font_00_cff_off000002ef.bin
2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca		 pdf-font-stream PDF embedded font (cff) at offset 0x2EF 499 bytes
font_01_sfnt_off00004666.bin
336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4666 48764 bytes
font_02_cff_off00017d4f.bin
b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe		 pdf-font-stream PDF embedded font (cff) at offset 0x17D4F 1390 bytes
font_03_cff_off00018686.bin
650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7		 pdf-font-stream PDF embedded font (cff) at offset 0x18686 5979 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.40, consistent with packed or encrypted content.
font_04_cff_off0001a110.bin
cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751		 pdf-font-stream PDF embedded font (cff) at offset 0x1A110 6612 bytes
font_05_cff_off0001bc24.bin
eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c		 pdf-font-stream PDF embedded font (cff) at offset 0x1BC24 3369 bytes
font_06_cff_off0001cba0.bin
498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1		 pdf-font-stream PDF embedded font (cff) at offset 0x1CBA0 2026 bytes
font_07_cff_off0001d6c2.bin
6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820		 pdf-font-stream PDF embedded font (cff) at offset 0x1D6C2 1370 bytes
font_08_cff_off0001e196.bin
c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29		 pdf-font-stream PDF embedded font (cff) at offset 0x1E196 3996 bytes
font_11_cff_off000239a9.bin
fbf22266dae0292a560fe4992b55ae8d9a60e5393b8105c8e8d7d4434902074f		 pdf-font-stream PDF embedded font (cff) at offset 0x239A9 1230 bytes
font_13_cff_off000246b7.bin
755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2		 pdf-font-stream PDF embedded font (cff) at offset 0x246B7 2550 bytes
font_15_cff_off00026f6a.bin
ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d		 pdf-font-stream PDF embedded font (cff) at offset 0x26F6A 2951 bytes
font_17_sfnt_off0002b4ec.bin
80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B4EC 52108 bytes
font_21_sfnt_off0004f70a.bin
2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F70A 23432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.