PDF malware analysis — malicious · 2929f21b2d48903e

MALICIOUS

PDF

6.6 KB Authoring application: Tisilarehaue (via 45772Tibedegabala)

MD5: 61e2bee9700ec723d54bf26d3a3f8c2e SHA-1: 13bf872776219b614530693a407c447290e27591 SHA-256: 2929f21b2d48903e850f31d321501f1e78d1e326c05d9ccae68ef2b51dce20bc

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript

The critical ClamAV detection and the presence of embedded JavaScript strongly indicate malicious intent. The JavaScript action, detected at offset 0x1202, is characteristic of exploits that download and execute further stages. While the document body is unreadable, the technical indicators point to a PDF exploit leveraging JavaScript.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36142 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36142
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `d4dce4f95f7146e3b127d68edf45ceb045483a205d9e9a2a53d6e6b80d83b663`	pdf-javascript-stream	PDF /JS object 10 at offset 0x1230	1728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.