PDF malware analysis — malicious · 2eafa8f2afc42d87

MALICIOUS

PDF

3.9 KB Created: 2008-06-14 19:47:42 Authoring application: Devill (via Blackpad)

MD5: 80631d03a77ded4830a608f775c3bb20 SHA-1: 9fc04bb47099c205a7ce488f492a856e699301be SHA-256: 2eafa8f2afc42d87690e6430322f28989d1a1ea2fc03b260ee5033b3f10a2a15

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. ClamAV detection as Pdf.Exploit.Agent-14341 further confirms its malicious nature. The embedded JavaScript is likely designed to exploit a vulnerability within the PDF reader to download and execute a secondary payload, a common technique for initial access.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-14341 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-14341
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `509ee7ce839f081cda4dc3abdf62fc400c6aed3ffa41902d1b8595127b8fa693`	pdf-javascript-stream	PDF /JS object 6 at offset 0xC13	412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.