Malicious PDF / .RAW — malware analysis report

Static analysis result for SHA-256 2538b4bb35dc63a9…

MALICIOUS

PDF / .RAW

14.5 KB Created: 2009-11-15 19:41:70 Authoring application: PDF Library 4.3.9 (via PDF Library 3.9.7)
MD5: 38f6e9a9aae5149210b19d5a4c00b08d SHA-1: 8f4450ee82c4b6eb2377b6411901019fab9adfac SHA-256: 2538b4bb35dc63a90ada4f5ed64fe3f1c960448a91645abfab34fdcc20d50b53
138 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV with the signature Win.Trojan.Agent-36166. Static analysis revealed embedded JavaScript, indicating an attempt to execute arbitrary code. The differential parser also failed, which can sometimes occur with obfuscated or malicious content. The primary IOC is the ClamAV detection signature.

Heuristics 5

  • ClamAV: Win.Trojan.Agent-36166 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36166
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
4634b641814d9460e1a2f479adaaf79abc5772644db82273dbddf189751790c5		 pdf-javascript-stream PDF /JS object 7 at offset 0x1A5 75185 bytes
Detection
ClamAV: Win.Trojan.Agent-36166
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.