Malicious PDF — malware analysis report

Static analysis result for SHA-256 3aac363b46e5f592…

MALICIOUS

PDF

11.1 KB
MD5: c76c9f9c4d6a8cc25a8aa14a67c304f4 SHA-1: abeb424e109b07ba6d89f74f0473e0d0ac021a78 SHA-256: 3aac363b46e5f5929d37ace166b140f7760b5158da9f4649bc8a0125eaac5cea
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by ClamAV as Pdf.Dropper.Agent-7251002-0 and a machine learning classifier indicated a high probability of maliciousness. Embedded JavaScript, common in PDF-based malware delivery, was detected. The primary function appears to be dropping a secondary payload, as indicated by the ClamAV detection name.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7251002-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7251002-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0045_000.js
9be4dab4f49020db0cf9e6f27b9f46caf4ba61133685dd0516d78893492f6ceb		 pdf-javascript-stream PDF /JS object 45 at offset 0x193 27481 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.