Malicious PDF — malware analysis report

Static analysis result for SHA-256 51a9925ccbf1e317…

MALICIOUS

PDF

3.2 KB
MD5: 4720d5a28755a4acabe6ca604c16c0c3 SHA-1: 84a2b10c3b9b6fc9cfb15ad120df7123c8e7bc78 SHA-256: 51a9925ccbf1e317aa06e462c0f6759a38fc020887d637b3300a03bf1167db8e
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript

The PDF file contains embedded JavaScript, as indicated by multiple heuristic firings and the presence of a javascript_obj0007_000.js artifact. The ClamAV detection 'Pdf.Exploit.Agent-36121' strongly suggests this JavaScript is malicious, likely exploiting a vulnerability to download and execute a secondary payload. However, the JavaScript content itself is not directly visible or reconstructible from the provided evidence, limiting the ability to detail its specific actions or identify IOCs.

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
e495a9058746b33d93ec3d2f98764100fc5de0c2ed2c6542ea3ada90f08eb311		 pdf-javascript-stream PDF /JS object 7 at offset 0x9C7 464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.