PDF malware analysis — malicious · 3cdbd6b5803d73fe

MALICIOUS

PDF

10.9 KB First seen: 2021-01-11

MD5: c80d238d0824c5fcdfd723e6b54adda4 SHA-1: e05e73429e00512d39aa95172b37b74834295479 SHA-256: 3cdbd6b5803d73fe08417d17280f3df90538e8c4b7e4a92a882edd0487b7f783

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF sample contains obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_OBFUSCATED_NAME_OBJECT. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded JavaScript is likely used to exploit a vulnerability and download a secondary payload, a common technique for initial execution and further infection.

Machine Learning

Nyx PDF Classifier malicious score 0.9987

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Hex-obfuscated scripting name object critical PDF_OBFUSCATED_NAME_OBJECT

A PDF name object that drives script execution (/JavaScript or /JS) is written with #XX hex escapes to hide it from string-based scanners — e.g. /J#61v#61S#63r#69p#74 decoding to /JavaScript. Legitimate PDF producers always write these names literally; hex-encoding an executable name is a deliberate evasion used by exploit-kit and dropper PDFs.
JavaScript action low 1 related finding PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.