Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cebc47e9f647701…

MALICIOUS

PDF

134.7 KB Created: 2009-08-11 12:43:52 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)
MD5: b52bde460eded392c263c72054e06693 SHA-1: b44f717983b89d7a7a7983fd7b025efa20050058 SHA-256: 5cebc47e9f6477011b4b02d2f8ee1229731b4baffcaa54ed2b5fe277e4c84876
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and identified by ClamAV as Pdf.Dropper.Agent-7264192-0. The JavaScript is obfuscated but appears to be designed to download and execute a second-stage payload. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9722

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7264192-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7264192-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0062_000.js
56a50d929218821958c85cde90f844167ce8f0d42055f7f6e1301bb666c02d4b		 pdf-javascript-stream PDF /JS object 62 at offset 0x12770 113474 bytes
javascript_obj0063_001.js
0ccfbd7c2effc8d1017edf47fa605901d1f8537687b746c621d79f02a58e1da5		 pdf-javascript-stream PDF /JS object 63 at offset 0x1DFFB 34137 bytes
javascript_obj0064_002.js
fd4b12fb4a32670751ae1edcca843f631b0ed774d2c1348b426f6d7f86ce73c1		 pdf-javascript-stream PDF /JS object 64 at offset 0x210CA 81 bytes
javascript_obj0065_003.js
206015c79f670e6c6f9390481f24f46b3b0fb0101e3a2fada2d34e3a39849542		 pdf-javascript-stream PDF /JS object 65 at offset 0x21158 62 bytes
javascript_obj0066_004.js
d00f01bd988bbf1a22c1840a8b51151c2152634934fe5990b10bdc1e66a3c2eb		 pdf-javascript-stream PDF /JS object 66 at offset 0x211E6 48 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.