Malicious PDF — malware analysis report

Static analysis result for SHA-256 635e8bb6b20542ff…

MALICIOUS

PDF

43.4 KB Created: 2006-10-03 13:54:05 -05:00 Authoring application: OmniForm Premium (via APJavaScript 2.2.1 Windows SPDF_1112 Oct 3 2005)
MD5: b9fc1ff1295a5b07bea4d2db5fbcb9ef SHA-1: 6a31cdd35359cd9f994447558da33f98bfb8f2e4 SHA-256: 635e8bb6b20542ffad0c649e306c54482b7ba737c902f74041acbd0b9dac31e5
206 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by multiple heuristics and an ML classifier, specifically flagging it as a JavaScript exploit cluster and an embedded script payload. The ClamAV detection name 'Pdf.Dropper.Agent-7266728-0' further supports its nature as a dropper. The embedded JavaScript, although not fully detailed here, is the primary mechanism for exploitation, likely leading to the download of additional malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 9

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Dropper.Agent-7266728-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7266728-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/3.0/
    • http://www.xfa.org/schema/xfa-template/3.0/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000a39d.js
d1dfd457a2fdd3cec4091f689f39b85b35666aa5599ef3a8d5f9a80d1e2ce105		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA39D 1042 bytes
font_00_type1_off0000a84b.bin
c6bf78478c9c4dd5b3b86554d34c78f847f70af4118f9ff083c1fccf0e8e932b		 pdf-font-stream PDF embedded font (type1) at offset 0xA84B 97 bytes
font_01_type1_off0000aada.bin
b749644b3e758e7335900ab2e7499eaa64b3a946849f1f8a0948287bdd96763d		 pdf-font-stream PDF embedded font (type1) at offset 0xAADA 144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.