Pdf.Dropper.Agent-7256419-0 PDF malware analysis — malicious · 463461a3a3400d94

MALICIOUS

PDF

885 B Created: 2011-72-51 03:25:00 Authoring application: ring.fromCharCode

MD5: 795ff4b12d9dbae6e69f1d0e4db32335 SHA-1: 58771fcd440021ee4d93d10eea6994b652c0f2da SHA-256: 463461a3a3400d94add3b2ddefdeed1460f9abc8294d9666aa4f877dd973461e

76 Risk Score

Malware Insights

Pdf.Dropper.Agent-7256419-0 · confidence 85%

MITRE ATT&CK

T1204.002 Malicious File: Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. ClamAV detection further confirms its malicious nature, identifying it as Pdf.Dropper.Agent-7256419-0. The embedded JavaScript is likely responsible for downloading and executing a secondary payload, a common technique for dropper malware. The document body text appears to be obfuscated or contains irrelevant data, providing no direct clues to the lure.

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7256419-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7256419-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `b4e6361b26885bd41e584c0507f6ff5a835b47869f13f4eb603c7714c04275f5`	pdf-javascript-stream	PDF /JS object 1 at offset 0x11F	394 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.