Malicious PDF / .SWA — malware analysis report

Static analysis result for SHA-256 4d91139f78a92e8d…

MALICIOUS

PDF / .SWA

7.2 KB Authoring application: Bofatezozinefaxfa (via 51b54Vogewojixariuawi)
MD5: 889293d2d432faea91f3a54e69859e1c SHA-1: 9a0339bf3d3e166fe588866e9b1fd235fe3bf47a SHA-256: 4d91139f78a92e8d9d5d697e8455a32e2897975a19e979d10ad8a9f4db8c0260
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1559.001 Component Object Model

The PDF file contains embedded JavaScript, indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristic firings. The ClamAV detection 'Heuristics.PDF.ObfuscatedNameObject' further suggests malicious intent. The embedded JavaScript stream, named 'javascript_obj0011_000.js', is the primary artifact and likely responsible for executing the malicious payload.

Heuristics 3

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0011_000.js
ca838ab153ea9de4fff1e74bdd0848fd720f71bc6fbee4425be234136cd19b41		 pdf-javascript-stream PDF /JS object 11 at offset 0x1349 2325 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.