PDF malware analysis — malicious · 20230d4f3724a6b8

MALICIOUS

PDF

11.8 KB

MD5: c46108a8a0c96540e8f910e224f1b2d5 SHA-1: 80506667c35f082fe647e25a16a22e0927e2d3cc SHA-256: 20230d4f3724a6b80f3a21a700a0b2eafe9abd98f1c0b15820b33d0d63ff4125

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically targeting PDF vulnerabilities. The embedded JavaScript is likely responsible for executing a malicious payload, although the exact nature of the payload cannot be determined from the provided evidence. No specific IOCs were extracted from the JavaScript itself.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36177 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36177
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `a7e6203b0e8f812879ed8382ccbb3900ad81b5a92faf27692f51de6e8c96c13a`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A6	569 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.