Malicious PDF — malware analysis report

Static analysis result for SHA-256 616fdf2705d81e0f…

MALICIOUS

PDF

173.7 KB Created: 2009-11-10 16:50:16 +08:00
MD5: 32f24ff319eeb16e98c9673d4972b9ea SHA-1: b446683c005acc463d9297325342abe4124194ed SHA-256: 616fdf2705d81e0f81e7941752ad12138fda831b4ce5f45694afde6b554b1487
318 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that utilizes eval() and unescape() functions, indicating an attempt to obfuscate malicious code. This JavaScript is likely responsible for downloading and executing a secondary payload, as suggested by the 'PDF JavaScript exploit cluster' heuristic and ClamAV detection of 'Pdf.Exploit.Agent-35646'. The presence of embedded JavaScript and exploit-related heuristics strongly suggests a malicious document intended for exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8846

Heuristics 10

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/pdf/1.3/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00000678.js
67d3623cb23a9b6ffa6c7dada049367157d17a9615a1e1b96ce98c5eabd16abc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x678 5257 bytes
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
objstm_0026_00.bin
bd6bbaefb25062e8f24a8e08b3415a73d64c377b0f0ea7e14adbce4dbe31a875		 pdf-objstm-decoded PDF /ObjStm 26 0 obj (inflated) 306 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.