PDF malware analysis — malicious · 680a04f85fa9d7c0

MALICIOUS

PDF

58.8 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via ubst)

MD5: 3b19ef9abb4f9a69607d109e1481acb9 SHA-1: 3e76665e224cd73a51b18eb40dac48a6258a5748 SHA-256: 680a04f85fa9d7c098548c84e9382467fa6b4057219950e6e75a13f926bf1a67

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The critical ClamAV detection and high ML score indicate malicious intent. The embedded JavaScript, identified by PDF_JAVASCRIPT and PDF_JS heuristics, is designed to execute code, likely downloading a secondary payload as suggested by the ClamAV detection name 'Pdf.Exploit.Dropped-94'. The JavaScript code itself is heavily obfuscated, making precise analysis of its actions difficult, but its presence and the other indicators strongly suggest exploitation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `9cb902898476e472d278495d6e090121ba5a7ce8dd4b514e8e7fce43eb94dfd0`	pdf-javascript-stream	PDF /JS object 76 at offset 0x99B	50250 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.