PDF malware analysis — malicious · 3277bfb4332ad477

MALICIOUS

PDF

12.6 KB Created: 2018-09-03 11:16:31 +03:00 Authoring application: iTextSharp222 5.5.10 2512000-2016 iText Group NV (AGPL-version)

MD5: 08e60aa6eb70bbe67acf3e0c85bf719b SHA-1: 3559a6a40d6123eccef0558c403a490506241594 SHA-256: 3277bfb4332ad477de63527b5cc8568a6192d0912dd7224335450e5396a84d66

246 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF contains embedded JavaScript and an embedded file, both flagged as malicious by ClamAV. The embedded file, '03092018.pub', is identified as a downloader. The presence of JavaScript and an embedded executable payload strongly suggests the PDF is designed to download and execute a secondary stage. The ML classifier also flagged this PDF with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 6

ClamAV: Doc.Downloader.Olemal-6668035-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Olemal-6668035-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`03092018.pub` `6e3631e75b99574abdb07fec2729afd5af7fe3e2b002413c0cd59aca58ca156c`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0xAC	47616 bytes
Detection ClamAV: Doc.Downloader.Olemal-6668035-0 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.