Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e31c241793bcb2c…

MALICIOUS

PDF

45.2 KB
MD5: 49319ce294343b9130fc7fbc11ffabd4 SHA-1: 58147d9701a0cd22d9c337a290b081a885e5bcf3 SHA-256: 2e31c241793bcb2c2e868bee78d2f9b53eb7f4e1297de09004bab34a5bcea553
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The presence of JavaScript suggests an attempt to execute arbitrary code. While the document body is heavily obfuscated and unreadable, the critical ClamAV detection for 'Heuristics.PDF.ObfuscatedNameObject' further supports malicious intent. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, a common technique for malware delivery.

Heuristics 5

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
617a5540708e96080d348f3a95f72b1c00f9a26ee962eadd5b4f553e9e8ed0cd		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1E4 3676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.