Malicious PDF — malware analysis report

Static analysis result for SHA-256 472580c6c55e42c3…

MALICIOUS

PDF

7.7 KB Created: 2009-12-03 19:47:52 Authoring application: PDF Library 7.3.7 (via PDF Library 1.3.4)
MD5: bb79fd5c2c86af9e8c2d1807b1ca24e6 SHA-1: e1fba7a56b345bc967e04f3cce396eb8c9706fd4 SHA-256: 472580c6c55e42c373cc71b829185479353a8044b9b3100da36f2319a8a736be
146 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Dropper.Agent-7256772-0' and an ML classifier indicating high maliciousness. The presence of embedded JavaScript, specifically 'javascript_obj0007_000.js', suggests the document is designed to execute malicious code. The JavaScript likely downloads and executes a second-stage payload, a common technique for dropper malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • ClamAV: Pdf.Dropper.Agent-7256772-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7256772-0
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
4a5000a59a27a0a2eba1f45e29354bdb63d7447362892f2682c4457cd47423f9
pdf-javascript-stream PDF /JS object 7 at offset 0x268 37689 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long hex-escaped blob(s).