PDF malware analysis — malicious · 40d419582736b5fe

MALICIOUS

PDF

2.1 KB

MD5: f240295cb39f9479540b58434283106e SHA-1: eaf4362097c099d87d8c91579a2925d9043e788a SHA-256: 40d419582736b5fe3c3c1e44f280379d5298f93c4c5a84d65cc6f202e88768c1

194 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File Execution: Malicious File T1553.005 Subversion: Mark-of-the-Web Bypass

This PDF document is designed to deliver the EICAR test file. The document body explicitly mentions the EICAR test file and provides a clickable element that, when interacted with, triggers the export and execution of the embedded EICAR.txt file. The presence of embedded JavaScript and PDF-specific obfuscation techniques further indicate malicious intent, although the primary payload is the EICAR test file itself.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 6

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`EICAR.txt` `275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f`	pdf-embedded-file	PDF EmbeddedFile object 10 at offset 0x62C	68 bytes
Detection ClamAV: Eicar-Test-Signature Obfuscation or payload: unlikely
`javascript_obj0008_000.js` `c79586b6ce33258a4a3246f592054a0720afaa39e08ec5d2fa6c2c1d19c42b91`	pdf-javascript-stream	PDF /JS object 8 at offset 0x4FF	58 bytes
`javascript_obj0008_001.js` `a99f0aad140b19a3f2f03812ca412c6d983fae48b9344738a95bf360fb8f644c`	pdf-javascript-stream	PDF /JS object 8 at offset 0x4FF	56 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.