Malicious PDF — malware analysis report

Static analysis result for SHA-256 38307e7fa6344a35…

MALICIOUS

PDF

145.6 KB Created: 2008-05-18 21:50:46 +04:00 Authoring application: PDFCreator Version 0.9.0 (via AFPL Ghostscript 8.53)
MD5: bab80236fbaa1e241cc0f856c4351a84 SHA-1: 17acd4de827e726c727c0c8cc9c4e872a328ee6c SHA-256: 38307e7fa6344a35c69236d71a871a1d0e7bd4d091019b6fc62243469a3d538e
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV detection as 'Pdf.Dropper.Agent-1507032'. The presence of JavaScript actions and embedded JS streams indicates that the document is designed to execute code. The ML classifier's high confidence score further supports the malicious nature of the file, suggesting it acts as a dropper for other malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8013

Heuristics 5

  • ClamAV: Pdf.Dropper.Agent-1507032 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1507032
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00021bce.bin
18160695d6a5de65f93e0a8675dcdc679a30a1f44c2f35f4ae4a76c8c8774082
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x21BCE 428 bytes
font_00_sfnt_off000029b7.bin
c0f7df7b4c0e3f7641e38f94f6483d97d081649c36d5f87d3c1a5d82a4132acf
pdf-font-stream PDF embedded font (sfnt) at offset 0x29B7 32792 bytes