PDF malware analysis — malicious · 5700acaa21b741fd

MALICIOUS

PDF

13.2 KB

MD5: 44efbfa328e65bc2066ebcf7fc36b849 SHA-1: 8b7fc1c26193d6abe213c36063ef8f4956006640 SHA-256: 5700acaa21b741fdabec1fdad8b54f1fc8a96fe85da6fbfc235f057f11fe1763

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Win.Exploit.Jailbreak-1, indicating it exploits a known vulnerability. The PDF structure and embedded artifacts suggest it is designed to deliver a payload upon opening. No specific IOCs were extracted beyond the detection signature.

Heuristics 2

ClamAV: Win.Exploit.Jailbreak-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.Jailbreak-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_cff_off00000458.bin` `083bb8c820092cf80f34c23785fccf6447dba00d0a959dc54908a80af9593b3c`	pdf-font-stream	PDF embedded font (cff) at offset 0x458	40357 bytes
Detection ClamAV: Win.Exploit.Jailbreak-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.