PDF malware analysis — malicious · 60000c5090a27b2b

MALICIOUS

PDF

59.4 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via ubst)

MD5: 0300161a3e68e396dfc5d3f9335514a9 SHA-1: 515ca9e41b9cd8fbeea07fa11a9734314734b343 SHA-256: 60000c5090a27b2bcc8eaeec8b570b41556cddd8d5bdad1854050b8375130920

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and a critical ClamAV detection (Pdf.Exploit.Dropped-94). The JavaScript appears to be heavily obfuscated but is designed to execute code, likely downloading a secondary payload. The ML classifier also strongly indicates maliciousness. Given the nature of the exploit and the embedded script, the most probable initial access vector is spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `d5ed0fa6a2ac64370070d8059b705717b6620e010b666dc23a49689ee98a90d5`	pdf-javascript-stream	PDF /JS object 76 at offset 0x99B	50813 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.