PDF malware analysis — malicious · 2ba796c404413078

MALICIOUS

PDF

3.1 KB

MD5: d1a8c2fcfbe1e2acdd9705ab757db3c9 SHA-1: 8a2b9e417d015dd328c2951f782a3b74331bdccd SHA-256: 2ba796c404413078ab70754d2915e579917dab34ea64fc4ec49ab21a94b5b0b3

176 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious File T1566.001 Spearphishing Attachment T1566 Phishing

The PDF contains embedded JavaScript and an embedded file named PO.doc, which was detected by ClamAV as Rtf.Exploit.CVE_2017_11882-6584355-1. This indicates the sample is designed to exploit CVE-2017-11882 to deliver a malicious RTF payload. The embedded JavaScript action 'this.exportDataObject' further suggests an attempt to launch the embedded file.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 6

ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_11882-6584355-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`PO.doc` `56048d84bc726d923a41637ab27f079ec4f47700baf3b547886acd02ee32cd91`	pdf-embedded-file	PDF EmbeddedFile object 8 at offset 0x37A	7354 bytes
Detection ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`javascript_obj0009_000.js` `924cfe89aae2bfa81becb0713a7f25e0c1569d41c5f10ce730b91ea8187126ab`	pdf-javascript-stream	PDF /JS object 9 at offset 0xAD6	55 bytes
`javascript_obj0009_001.js` `af80b23798fcbe95afb8b17f27265f45f3407be29046853b330e9dc32c21ceb1`	pdf-javascript-stream	PDF /JS object 9 at offset 0xAD6	53 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.