PDF malware analysis — malicious · 332a633753d5687c

MALICIOUS

PDF

4.4 KB Created: 2009-08-23 19:47:07 Authoring application: Elra 2.5.4.3 (via PDF Library 4.8.1.5)

MD5: a57cb702fd7163b4cede1beabd911488 SHA-1: 4fec8f98dbfd66e5729dfd44b7f967b30e632928 SHA-256: 332a633753d5687c3cc98a8ed2922c56fec8837e48eb714fb79169e06a0489cf

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Dropper.Agent-7247037-0' and a high ML classifier score. The presence of embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS firings, suggests the document is designed to execute malicious code upon opening. This code likely exploits a vulnerability to download and execute a secondary payload, a common dropper behavior.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7247037-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7247037-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0014_000.js` `ab9c35a022fd2eb72ffaf7e907e0a5a79ce086af79f8f60970591f66ffa6823e`	pdf-javascript-stream	PDF /JS object 14 at offset 0x398	43347 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.