PDF malware analysis — malicious · 4aee98d85bbee75c

MALICIOUS

PDF

7.3 KB Authoring application: Tooqimeqipigafara (via 09007Renizaxizo)

MD5: 70a1e6db099eac2e79714a5a73cd9829 SHA-1: d81f524b6d9144f8a2292e3ca4f041d9d8b2d112 SHA-256: 4aee98d85bbee75cf83d33307a6b5e175e8d3e692cd1c80977362770d8a9d1c6

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection 'Heuristics.PDF.ObfuscatedNameObject' further suggests malicious intent through obfuscation. The embedded JavaScript is likely responsible for executing the malicious payload, though its exact function is obscured. The document body is unreadable, providing no further context.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `b53e27bbdeba8c818850cc3826b3d643c06114ca0ccd161a827d53f8e26598c4`	pdf-javascript-stream	PDF /JS object 10 at offset 0x130D	2214 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.