Malicious PDF — malware analysis report

Static analysis result for SHA-256 2299b2f38c168c40…

MALICIOUS

PDF

110.0 KB
MD5: 85776d2e028db1a06379a490d7771c46 SHA-1: ee1d82368c90eb64885e44631762bdb52aea4669 SHA-256: 2299b2f38c168c400a00d4e609df63661b23ad8904ad0f2495a3d65c7bc81120
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. This JavaScript is likely used to download and execute a second-stage payload, as suggested by the ClamAV detection name 'Pdf.Dropper.Agent-7239016-0'. No specific IOCs such as URLs or hashes were extracted from the static analysis.

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7239016-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7239016-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.