PDF malware analysis — malicious · 2d6556f1f7896bb4

MALICIOUS

PDF

809.3 KB

MD5: f3b9663a01a73c5eca9d6b2a0519049e SHA-1: d7579cc146fb3fe215a83bf36cefbeef96990a91 SHA-256: 2d6556f1f7896bb4b969cf778ba28618e7700e7ae928af49b9a6e869855bf5a4

114 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including PDF_JAVASCRIPT and PDF_JS, indicating the presence and execution of embedded JavaScript. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, as indicated by the 'Pdf.Dropper' ClamAV signature. The document body contained mostly binary garbage, providing no contextual clues about the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 4

ClamAV: Pdf.Dropper.Agent-7244125-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7244125-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_000_off0006d90c.js` `dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6D90C	289498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.