PDF malware analysis — malicious · 1ba39b76d9d7ec15

MALICIOUS

PDF

1.95 MB Created: 2009-11-15 19:41:70 Authoring application: PDF Library 4.3.9 (via PDF Library 3.9.7)

MD5: af0df2d08b0920e36a133e9cb62efffa SHA-1: 926653c1bf77de887b9d293e0e4b5d57cddc008c SHA-256: 1ba39b76d9d7ec1592c28146644c5154b9101585078ac04b6281cac12e76c588

228 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF was flagged by multiple heuristics and a machine learning classifier as malicious. It contains embedded JavaScript and a secondary PDF, indicating a likely multi-stage attack. ClamAV detection of 'Win.Trojan.Agent-36166' further confirms its malicious nature. The presence of JavaScript actions and embedded JS streams suggests the script is used to download and execute a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 6

Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
ClamAV: Win.Trojan.Agent-36166 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Agent-36166
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `eb2ec6c0982b2e6e427d93fd584c1c063c4ec8b53a463bb0679cac7c5fe30b66`	pdf-javascript-stream	PDF /JS object 7 at offset 0x2275	75126 bytes
Detection ClamAV: Win.Trojan.Agent-36166 Obfuscation or payload: unlikely
`polyglot_child_pdf_off000020d0.pdf` `ed18663a8cf2b28dc76f5236d5c8474045a9b21d74df22c853db7c767189f5ed`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x20D0	2039600 bytes
Detection ClamAV: Win.Trojan.Agent-36166 Obfuscation or payload: unlikely
`polyglot_child_pdf_off00005a8d.pdf` `8d3dd29aa6c853a58f6ba7c53796312adb86c7da735d270dcf281dfc1791e16d`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x5A8D	2024819 bytes
Detection ClamAV: Heuristics.PDF.ObfuscatedNameObject Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.