PDF malware analysis — malicious · 1ebd2fcffb72d93e

MALICIOUS

PDF

37.2 KB Created: 2010-02-16 19:13:20 +03:00 Authoring application: TCPDF (via TCPDF 4.8.032 (http://www.tcpdf.org))

MD5: 5436c45eff4b337146ac5da02ef9e54d SHA-1: 9d119bec2d49c5911ec23605295afcf45a376d88 SHA-256: 1ebd2fcffb72d93eb9d505898bc272103633f3bf82cd8e851563e8aaacf969e7

84 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The ClamAV detection 'Pdf.Exploit.Agent-13372' strongly suggests this is a known exploit. The embedded JavaScript, which is 8038 bytes in size, is the likely mechanism for delivering the exploit. The purpose of the script is presumed to be downloading and executing a secondary payload, a common technique for PDF-based malware.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-13372 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-13372
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `60d1f8a9d172c86665b1fe6dfcfad5cf7d77aff17377dd821ae307059a92229f`	pdf-javascript-stream	PDF /JS object 10 at offset 0x707B	8038 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.