PDF / .SWA malware analysis — malicious · 3cfe5ff4b52ffa79

MALICIOUS

PDF / .SWA

7.8 KB Created: 2010-09-21 20:42:51 Authoring application: Doxifajahigjobe (via 5ec74Tomawaliuepizi)

MD5: 6900a8cff72f43e73e9d8179490f7f61 SHA-1: 897c6b9057460d3f6c6ff86ad7a4d4981e354253 SHA-256: 3cfe5ff4b52ffa79b94514c00aee03daf7900849a5bd15c073b839d9d1dd8aab

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV with the signature Heuristics.PDF.ObfuscatedNameObject, indicating obfuscated content. Embedded JavaScript was also detected, suggesting an attempt to execute arbitrary code. The specific intent of the JavaScript could not be fully determined due to obfuscation, but it is likely designed to download and execute a secondary payload.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `9106999da8553f6c6b05a4ae46a0e61bbc3c0afca5556084b61a1c3623a2a08e`	pdf-javascript-stream	PDF /JS object 11 at offset 0x133F	3122 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.