Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c2f4db49053bbf3…

MALICIOUS

PDF

80.5 KB Authoring application: FOP 0.20.5
MD5: da96675f7d39f5e096045015ec36fc5d SHA-1: 7fdd8039acca2a1095e079b6b700a42696bc779e SHA-256: 3c2f4db49053bbf3fac2f84012b5385177c255b2dd6ddbc5cf187cefd7a96fda
86 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. This script is likely responsible for executing an external URI, as suggested by the PDF_URI heuristic and the presence of multiple URLs. The ClamAV detection as Pdf.Exploit.Agent-21347 further confirms its malicious nature. The script's primary function appears to be redirecting the user to a potentially malicious website for further exploitation.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3035

Heuristics 6

  • ClamAV: Pdf.Exploit.Agent-21347 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-21347
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.xyzmo.com
    • http://www.dig.at
    • https://verify.xyzmo.com/UploadForm.aspx?MyFile=
    • https://verify.xyzmo.com.\\n\\nThe
    • https://verify.xyzmo.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0027_000.js
592db10defe20d4bb92ec7389df4a680eaaac281962e22d216c9f1a50a755d2a		 pdf-javascript-stream PDF /JS object 27 at offset 0x71EC 1819 bytes
font_00_sfnt_off00003bbf.bin
300ad9aedbeaf106a2088fd124c0315702994a4898a5ec69a42ba4f04a75f850		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BBF 5936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.