Malicious PDF / .SWA — malware analysis report

Static analysis result for SHA-256 39365fccf70fd194…

MALICIOUS

PDF / .SWA

6.7 KB Created: 2010-09-03 08:30:37 Authoring application: Xijokanilohova (via c1a32Kmgxaloxaxgi)
MD5: b40d1a512dd585a1afab4e5d7d318cff SHA-1: 2fd59d1b85d410c2eeb44a80f0ba395b24103d04 SHA-256: 39365fccf70fd194d4620c4d8d805a847c28f0cd69e2b0095b396a64dac40e93
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ClamAV with the rule Heuristics.PDF.ObfuscatedNameObject. Static analysis detected embedded JavaScript, indicating an attempt to execute arbitrary code. The obfuscated nature of the JavaScript suggests a downloader or exploit delivery mechanism, likely aimed at compromising the user's system.

Heuristics 3

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0011_000.js
d75aba2bc241d027161697fa7aada0bf45c7afe5b58fce1bb0bf66350349f123		 pdf-javascript-stream PDF /JS object 11 at offset 0x1208 1983 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.