PDF malware analysis — malicious · 54c3c13b6bd236ba

MALICIOUS

PDF

218.6 KB First seen: 2022-02-16

MD5: e61774a6905a18c503304ee2085c1806 SHA-1: 61eda5d78fde5930443be5280d9033c757c2b476 SHA-256: 54c3c13b6bd236bab7971c6635866b4ca335727e6f96f66491edabae3cbc65cd

178 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is a PDF with embedded JavaScript, flagged by multiple heuristics including a critical ClamAV detection for 'Doc.Downloader.Formbook'. The embedded JavaScript stream is likely responsible for downloading and executing a secondary payload, as indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristic firings. The ClamAV detection suggests this is a downloader for the Formbook family, though further analysis would be needed for definitive attribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9156

Heuristics 7

ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0025.bin` `e6eea2927bfc10c0daee9fdde5469647a604dae45dfe599fe8ae29e25967ad73`	pdf-embedded-file	PDF EmbeddedFile object 25 at offset 0x6D34	192120 bytes
Detection ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 Obfuscation or payload: likely Carved artifact entropy is 7.96, consistent with packed or encrypted content.
`stream_008_off0003420b.bin` `273270994f8bc3540df1f98f87ea5a0fedd04a2faf7266093c380d47ee63e846`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3420B	33120 bytes
`stream_010_off000366b2.bin` `0ce423d85024e066a44b320c90b9432140cd8b560dd0c1a0b407c46711613f0d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x366B2	1019 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.