Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c30c3a2c588b339…

MALICIOUS

PDF

16.6 KB Created: 2010-03-10 18:13:46 Authoring application: Icimilemobigi
MD5: 1618326b3a9fa45360c4cb11d2a767bb SHA-1: d458a06946e4af2d6a36bbdce16135d3b5f1c83e SHA-256: 5c30c3a2c588b3394712d9b6bc742d3aed39bb549dee85ab720607de7cdf214b
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF document contains embedded JavaScript, flagged by multiple heuristics and ClamAV as malicious (Pdf.Dropper.Agent-7263971-0). The JavaScript is likely responsible for downloading and executing a secondary payload, a common technique for malware droppers. The ML classifier also strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7263971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7263971-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0022_000.js
b3fc57622c3c499b40e92295a64572cac5bfca56ff30170ba26a8e443d949327		 pdf-javascript-stream PDF /JS object 22 at offset 0x3313 1176926 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.