Malicious PDF — malware analysis report

Static analysis result for SHA-256 271b139c06a29d56…

MALICIOUS

PDF

12.6 KB
MD5: 3e61fb6b0254f7b421f35ca19e6584b9 SHA-1: a20161a5191e0ed41e7acd6f5b05d902da9a34b4 SHA-256: 271b139c06a29d560e9bdbe3e7fecc15e4a8afb54fd65d7d4dfdc813c6313d2f
116 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, identified by the PDF_JAVASCRIPT and PDF_JS heuristics. The PDF_METADATA_EVAL_STAGER heuristic indicates that this JavaScript is used to decode and execute an exploit, as confirmed by the CLAMAV_DETECTION rule 'Pdf.Exploit.Dropped-94'. This suggests the PDF is designed to exploit a vulnerability to download and execute a secondary payload. No specific family could be identified.

Heuristics 4

  • ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
  • PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGER
    PDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
7f595efb6cd26070e35448ca43cb9a787b0eb91eba21ac4e4a19c8247df37ca5
pdf-javascript-stream PDF /JS object 76 at offset 0x3059 331 bytes