PDF malware analysis — malicious · 5957ef5ab9d588d5

MALICIOUS

PDF

19.8 KB Created: +jÜqì¸YÍ%_¥pÂóY¬¡ Authoring application: ,îX»AÀÜæi: (via ,îX£AÂÜêi(._ª:·iùThKÀ÷Y³ÊJcù)

MD5: 00be4103e42fd6b9489f29ecf6068677 SHA-1: 404eb3649119f399bf7ba14eadfbc0d41a69f62a SHA-256: 5957ef5ab9d588d59040bf18c49f3d0329f2688578262e433aed088c66d0faa3

146 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file was flagged as malicious by ClamAV with the signature Pdf.Exploit.Agent-7299. It contains embedded JavaScript, and the PDF is encrypted with JavaScript actions, indicating the payload is hidden from static analysis. The ML classifier also strongly indicated maliciousness. The primary attack pattern involves leveraging JavaScript within the PDF to conceal and execute malicious code.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Exploit.Agent-7299 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-7299
Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS

PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `45ffdbd026c70bc45e9a33e1fa83e368eb227797af14da7c67dd1a8a06543c08`	pdf-javascript-stream	PDF /JS object 12 at offset 0x35F0	5150 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.