Malicious PDF — malware analysis report

Static analysis result for SHA-256 55a870b1aa95bd20…

MALICIOUS

PDF

51.1 KB
MD5: 2c149a5d76a8c40b05ba445f9bc3b1d4 SHA-1: 86d4b150027b174a51c90ddd2d4df7daafde03f9 SHA-256: 55a870b1aa95bd20aa2151ed0d6ae860f1b06d61b403c608835ff0a1d26c838e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1566 Phishing T1204.002 Malicious File

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded script payload, indicating it's designed to exploit vulnerabilities within the PDF reader. The presence of XFA form elements further suggests a potential attack vector targeting Adobe's XFA processing. The embedded URLs, while not directly malicious, are related to XFA and PDF standards, which are often leveraged in exploit delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-6136306-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-6136306-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00000240.bin
f0074dbe67a2034ce0bd49210363d43c5240cc1e5d1f54868b8a77c85110d7db		 pdf-embedded-script PDF raw stream script payload at offset 0x240 51610 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.