Malicious PDF — malware analysis report

Static analysis result for SHA-256 376a55116e36156f…

MALICIOUS

PDF

15.1 KB Created: 2009-11-15 19:41:70 Authoring application: PDF Library 4.3.9 (via PDF Library 3.9.7)
MD5: 3d02ad436ca760e9bbe85b117f6a3261 SHA-1: 1369a0b03d4f600f5315efd8562b17c1d836f771 SHA-256: 376a55116e36156f066690afdc2046d1035764536f84c06ba41bcc1f87e212f5
138 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file triggered critical heuristics for ClamAV detections, specifically 'Pdf.Dropper.Agent-7249262-0' and 'Win.Trojan.Agent-36166' on an extracted artifact. The presence of embedded JavaScript, indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics, suggests that the document is designed to execute malicious code. This JavaScript is likely responsible for downloading and executing a secondary payload, a common technique for dropper malware.

Heuristics 5

  • ClamAV: Pdf.Dropper.Agent-7249262-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7249262-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
b62ead2357978a6654413285739cb66cd7ba8b162e1ebfe1c677b58a058e1ed1		 pdf-javascript-stream PDF /JS object 7 at offset 0x1A5 84696 bytes
Detection
ClamAV: Win.Trojan.Agent-36166
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.