Malicious PDF — malware analysis report

Static analysis result for SHA-256 251fced8e8e56d2b…

MALICIOUS

PDF

42.9 KB
MD5: f2d2a71f19333010473630a696b5b4dc SHA-1: 9cc29597c9c0343883eb953280242cb7706ae231 SHA-256: 251fced8e8e56d2b98961322d49d0b8f35bd6c480bf14b8830510a8bd765f5fc
186 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a PDF file flagged by ClamAV as Pdf.Exploit.Agent-36836, indicating it contains an exploit. High confidence is placed on this detection due to the critical heuristic firings and the ML classifier output. The PDF contains embedded files and XFA forms, which are common vectors for PDF exploits. The embedded script payload further supports the malicious nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • ClamAV: Pdf.Exploit.Agent-36836 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36836
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://ns.adobe.com/xtd/
    • http://www.xfa.org/schema/xfa-data/1.0/
    • http://ns.adobe.com/xfdf/
    • http://www.xfa.org/schema/xfa-form/2.8/

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin
04462f810d6eacdacecc9d0a5f3f81bebc722af4415e04da19b520338f642b51		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0xD7 67 bytes
embedded_file_obj0009.bin
685ec00ba8d1e3a207e91ad1ae9b8c5e3cbc4f5473feab31f711c3ce0e99d74b		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x162 681 bytes
embedded_file_obj0010.bin
e1ab66598406464785df1b7c3e4218452dce39c816aca3e1a181e312cbe8a05c		 pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x456 93 bytes
embedded_file_obj0011.bin
9ac76a7893892841a7b7d93386072e8e5ed607f9761e914140b674f45ee575bb		 pdf-embedded-file PDF EmbeddedFile object 11 at offset 0x4FE 413 bytes
embedded_file_obj0012.bin
6dfc2cfc739bf5cd5514e048143c782a1af7b4c86ed10bd88203471efa9b3fe7		 pdf-embedded-file PDF EmbeddedFile object 12 at offset 0x6E6 389 bytes
embedded_file_obj0014.bin
7bdb1a5aab139ade4b9693f280651ac3a15169b47e19840b0a8e97f96fa9b36e		 pdf-embedded-file PDF EmbeddedFile object 14 at offset 0x8B8 40887 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36836
Obfuscation or payload: unlikely
embedded_file_obj0015.bin
51d6d76eddb1746e412f89f4d1c1b0d620c60fb4a5641c018e93871be63968a9		 pdf-embedded-file PDF EmbeddedFile object 15 at offset 0xA8B9 147 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.