Malicious PDF / .PHP — malware analysis report

Static analysis result for SHA-256 28e732c162f587ac…

MALICIOUS

PDF / .PHP

37.8 KB Created: 2010-04-11 20:37:22 +04:00 Authoring application: TCPDF (via TCPDF 4.8.032 (http://www.tcpdf.org))
MD5: 6b4e6758b30ec7168d964398e36bfc00 SHA-1: c1f6e30e47e1abfcedc8e36670efefb2ca6a7184 SHA-256: 28e732c162f587ac517b566dfee328215c656ea78613af5e89e4d0f17679a05e
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection of 'Pdf.Exploit.Agent-22586' strongly suggests this JavaScript is malicious, likely exploiting a vulnerability within the PDF reader to execute arbitrary code. The exact nature of the exploit is unclear without further analysis of the JavaScript, but it is designed to bypass security measures.

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-22586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-22586
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0010_000.js
2d7f2ec61add3c6b89639ed6884a625c756c7a86ada2a9558add86d451ed7439		 pdf-javascript-stream PDF /JS object 10 at offset 0x8CE3 1346 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.