Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e0a33a3d7d6351d…

MALICIOUS

PDF

59.0 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: lice (via ubst)
MD5: e1774d8a8d2b6176a486805d0f58ece3 SHA-1: 52a9221805a6b4050d139cb7b1fcce347bdcc1ba SHA-256: 5e0a33a3d7d6351d6f6a8eb244485a42fc12a7bab4603bc11dbb9175385858ce
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and detected by ClamAV as Pdf.Exploit.Dropped-94. The JavaScript code appears to be obfuscated but is designed to download and execute a secondary payload, indicating a typical dropper or exploit loader functionality. The ML classifier also strongly indicates maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
349f35653bb96c40dc7a639b715c70b339389999e21487ee7b33f506e49644c4		 pdf-javascript-stream PDF /JS object 76 at offset 0x955 50467 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.