Malicious PDF — malware analysis report

Static analysis result for SHA-256 5af8a8babb3c24d7…

MALICIOUS

PDF

33.2 KB
MD5: 1da1a4710562281e9c7e0842e1c9a5a0 SHA-1: 446ea929d1070a2f2faf231a5920adf4faa801df SHA-256: 5af8a8babb3c24d76d9385c9d3d95e89340734b7b0ca30624806366ffb619d3a
214 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by ML classifiers and ClamAV with critical severity, indicating malicious content. It contains embedded JavaScript and RichMedia (Flash) content, suggesting an attempt to exploit vulnerabilities or execute malicious code. The embedded Flash file 'uyiYImJjSM.swf' and the JavaScript stream 'javascript_obj0006_000.js' are key indicators of the attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 6

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
uyiYImJjSM.swf
82959a74bd2f365dbaff0af8a126e8d6efed63f658723f179f7020ea3628ed8b		 pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x1648 27931 bytes
Detection
ClamAV: Swf.Exploit.Kit-513
Obfuscation or payload: unlikely
javascript_obj0006_000.js
be15b3157c3748b3aafc9b62ec1b53d2cbf1dd171708ef522e2bbeb5f5cd6f19		 pdf-javascript-stream PDF /JS object 6 at offset 0x13C 3944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.