PDF / .SWA malware analysis — malicious · 0e6fb93ad05da954

MALICIOUS

PDF / .SWA

6.7 KB Created: 2010-08-28 07:57:17 Authoring application: Rgipejotihaqomelevo (via 03b37Rinolatarhe)

MD5: 192d91feca611cb7f3072a4c032f286a SHA-1: 9520b97bfb5ebc63d79690dcc9e8c7180dcc55e5 SHA-256: 0e6fb93ad05da954b03cc16bade2417fc791deb9ce9759ccaafd32e6c0ae421f

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a high-severity ML classifier and ClamAV detection for obfuscated objects, indicating malicious intent. The embedded JavaScript, which is obfuscated and attempts to download and execute a second-stage payload, is the primary mechanism for exploitation. The authoring application and creation date suggest a potentially older but still active threat.

Machine Learning

Nyx PDF Classifier malicious score 0.9925

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `a9555a2f0ea50961fc938575406c2e91665cf88b3a765259271915271ad077c8`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1213	1857 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.