Pdf.Dropper.Agent-6335515-0 — PDF malware analysis

Static analysis result for SHA-256 367547f151358c3f…

MALICIOUS

PDF

6.6 KB
MD5: c37ae9efc4eefcf1fe9cefa69a9e51f4 SHA-1: 1d917b8bb8794064d5d8fbf917bd7342dd84a343 SHA-256: 367547f151358c3ff872bda0017ed0871842b946c7b61da5e4d91f48176a617d
180 Risk Score

Malware Insights

Pdf.Dropper.Agent-6335515-0 · confidence 95%

MITRE ATT&CK
T1204 Malicious Link T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.007 JavaScript

This PDF file exploits the CVE-2008-2992 vulnerability, indicated by the 'util.printf' heuristic firing. It contains embedded JavaScript, which is likely used to download and execute a second-stage payload. ClamAV also identified this as Pdf.Dropper.Agent-6335515-0, suggesting a dropper functionality.

Heuristics 7

  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • ClamAV: Pdf.Dropper.Agent-6335515-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-6335515-0
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser exited 1. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
36b55d102925a586d844418e9075490417c529c9078a3b9c34e29c3e790dcb2e		 pdf-javascript-stream PDF /JS object 6 at offset 0x1A9 5707 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.