PDF malware analysis — malicious · 45d54174ac051bf1

MALICIOUS

PDF

3.3 KB

MD5: 51d4f1f07926b7890aabefba6e3ceb64 SHA-1: 5676dc5cbc9cdd8b3edde5873fd25886b7fb90a8 SHA-256: 45d54174ac051bf189728014af929618f6217e276da73ba4a463e504c485271e

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was detected by ClamAV as 'Pdf.Exploit.Agent-36121', indicating it contains an exploit. Static analysis revealed embedded JavaScript, which is commonly used in malicious PDFs to deliver second-stage payloads or exploit vulnerabilities. The JavaScript action and embedded JS stream heuristics confirm the presence and potential execution of such code. The lack of readable document body text prevents a more specific determination of the lure, but the exploit and script presence strongly suggest malicious intent.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `6423abeed97a9fa45b2599b9f648c7398a1e80fd7082b39a81b4426991d08eb9`	pdf-javascript-stream	PDF /JS object 7 at offset 0xA81	334 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.