PDF malware analysis — malicious · 1c346a646f031ebf

MALICIOUS

PDF

45.1 KB Created: 2009-12-02 15:42:23 +03:00 Authoring application: sureIn (via 4452b5fc39a78f284e94582992f29e55)

MD5: c50f4429187c0244ad3fa2a823f29a8d SHA-1: 134d4325d2dbed016d898996e7359f0169df4a21 SHA-256: 1c346a646f031ebf063007dfc490985aa78f8d31d84bad2e95cfa91294ded80f

154 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript, with a high-confidence heuristic firing for an eval() call. This suggests the script is designed to execute arbitrary code. The ML classifier and ClamAV detection strongly indicate malicious intent, likely as a dropper for further malware. The script's obfuscation and use of eval() make it difficult to determine the exact payload, but the overall pattern is consistent with a malicious PDF dropper.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Dropper.Agent-7235842-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7235842-0
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0013_000.js` `68fef55eabeac350924db54660a7cd27ab1c07c70182ce262d6f9388d848e5b5`	pdf-javascript-stream	PDF /JS object 13 at offset 0x2122	4096 bytes
`javascript_obj0014_001.js` `560b8bc3469ae20671b3c244f87f4af1c52478d61e72e7a5cb40a701f869a427`	pdf-javascript-stream	PDF /JS object 14 at offset 0xAE8B	41 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.