PDF malware analysis — malicious · 577eda64d2a6acda

MALICIOUS

PDF

44.7 KB Authoring application: substr

MD5: 2cfdd44352389ac34bffd99e71d9d9b7 SHA-1: 780c3ea6e1c70301d1758d720d9154d19f2891df SHA-256: 577eda64d2a6acda08d0faa67858a4d457f456c0a3c0835178ee3194f9424f82

106 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution: Malicious File

The PDF contains embedded JavaScript, indicated by multiple heuristic firings and the presence of a JavaScript object. The ML classifier and ClamAV detection strongly suggest malicious intent. The JavaScript is likely used to exploit vulnerabilities within the PDF reader or download a secondary payload. The document body text is minimal and does not provide further context on the lure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Malware.Agent-7658961-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Malware.Agent-7658961-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `bb59fceda395d6bc7220dc7b477e7f51d5e63ad530656635d242e7a5db7a2335`	pdf-javascript-stream	PDF /JS object 1 at offset 0xAFFE	475 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.