PDF malware analysis — malicious · 5092aa1b3ff72a02

MALICIOUS

PDF

MD5: 417c1765386311c324dcc616a7858172 SHA-1: 0816c3069f82893dac4213268aa8bf3d5a6e9707 SHA-256: 5092aa1b3ff72a02c639560575251075e551497f4527ccb570dd446891a14aa2

114 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including ML classifiers and ClamAV, indicating malicious intent. The presence of embedded JavaScript and an embedded file suggests a dropper or exploit delivery mechanism. The ClamAV detection name 'Pdf.Dropper.Agent-7140475-0' strongly suggests its function is to download and execute further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Dropper.Agent-7140475-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7140475-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`5.docm` `ed7ae1e339015da0d3ae74125d2ad3a20713f3053824a30684b402a1594ebfdd`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x8B	43821 bytes
`javascript_obj0003_000.js` `7c1de427029e079a702df45dccca17f658844123bbee191e747a29358c5bc88d`	pdf-javascript-stream	PDF /JS object 3 at offset 0xA159	81 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.