PDF malware analysis — malicious · 1f48def5c0384b84

MALICIOUS

PDF

9.4 KB

MD5: 7e0deea6ccf6eb8dcc2c6a292a7fd86b SHA-1: e1d2373e825b8380a33bf2c3f9b99d16f2252be6 SHA-256: 1f48def5c0384b84e58182af4476522d33edbfdd24a9041a6ae0ee365335784d

84 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript T1204.002 Malicious JavaScript

The critical ClamAV heuristic 'Pdf.Exploit.Agent-36063' strongly indicates a known PDF exploit. The presence of embedded JavaScript streams, identified by 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics, further supports this, as these scripts are commonly used to deliver malicious payloads or exploit vulnerabilities within PDF viewers. The deobfuscated JavaScript stream, though large, likely contains the core malicious functionality.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-36063 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36063
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
syncAnnotScan annotation-staging primitive low PDF_FOXIT_SYNCANNOTSCAN

PDF JavaScript calls syncAnnotScan() — a no-op annotation-enumeration primitive used by exploit-kit JavaScript to stage payload reads from annotation /Subject fields before eval(). Not a vulnerable sink itself; rarely seen in legitimate PDFs. (matched in decompressed stream)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_000_off000001cb.js` `eb39e2de4dbbc100de6d3e30aa43ff78fa075618862ba1ebba5151ea3a3b848d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1CB	273 bytes
`deobfuscated.js` `06dc2b29942293ac00274b6f49fdb8f45b8241e41b756c2f1e98ca883a23ffd3`	deobfuscated-js	PDF JavaScript deobfuscation pass	36440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.