PDF malware analysis — malicious · 4c755d5e02987b0c

MALICIOUS

PDF

23.6 KB Created: 8jÝ¨pCJAÜn®êsÄ\B*3@ Authoring application: ¯ïÛA{4¤#¿òÞ4 (via ¯ïÈA{4¤"¿þÞ#ï)

MD5: cd58df1f78497bfb79df5b0e0a3667c6 SHA-1: b7646ffe9e05471759fc21d26d94b25212281d2a SHA-256: 4c755d5e02987b0cf536c841db52aeffff24ce251be29f6635ce11543bc80a70

154 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV with the signature 'Pdf.Dropper.Agent-7212258-0'. Static analysis revealed embedded JavaScript, which is used to encrypt the PDF content and hide the malicious payload. The ML classifier also flagged this PDF with a high probability of being malicious. The presence of JavaScript actions and encrypted content strongly suggests a dropper mechanism designed to evade static analysis and deliver a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Dropper.Agent-7212258-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7212258-0
Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js` `08b108b69dc44ca422e2235e5a5ac1657a7a19ee78515f6444688dd9167a70f0`	pdf-javascript-stream	PDF /JS object 9 at offset 0x3D1	21696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.