Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c2de781c57eba32…

MALICIOUS

PDF

7.9 KB
MD5: fe2ea9e4d95e882f0c263d3d5e2683c1 SHA-1: 4561c87b8c5851f21c181d3b9002f08864427e59 SHA-256: 0c2de781c57eba328b5ac4e8c42eb214e3a34742701bda28dbf528e93732ab21
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by multiple engines, including a high-confidence ML classifier and ClamAV. It contains embedded JavaScript, indicating an attempt to execute code. The presence of JavaScript actions and streams strongly suggests the PDF is a dropper, likely intended to download and execute a secondary payload, which aligns with the T1059.007 (JavaScript) and T1203 (Exploitation for Client Execution) MITRE ATT&CK techniques. Given its nature as a malicious document, it was likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7227799-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7227799-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.