PDF / .PHP malware analysis — malicious · 447729da6ac655a1

MALICIOUS

PDF / .PHP

9.7 KB Created: 2009-02-19 14:45:49 -02:00 Authoring application: Writer (via OpenOffice.org 3.0)

MD5: aa42262641c0d51a7035ce8d0dc0aaca SHA-1: 10eca7d8c4b767a6e16cc6b2ebf1d5214d82fd00 SHA-256: 447729da6ac655a14cb61680758b0a3e65254dca55756c49750b481b61aa08a4

98 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of a PDF_LAUNCH action and a PDF_EVAL heuristic firing suggests that the embedded JavaScript is intended to be executed, likely to download and execute a second-stage payload. The JavaScript stream itself is obfuscated, making a precise determination of its actions difficult, but the combination of heuristics points to a malicious intent.

Heuristics 5

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0027_000.js` `a379fc88304319753bd393297607b779532c097f4323f1af0c00bacb56426526`	pdf-javascript-stream	PDF /JS object 27 at offset 0x1C1B	3348 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.