Malicious PDF — malware analysis report

Static analysis result for SHA-256 687ca1fc371821b5…

MALICIOUS

PDF

45.0 KB
MD5: 1ebd788a51c18eda3e2af560cfd27708 SHA-1: ccf2f3ab29dc40db48590ae4041ba13b9953f2f2 SHA-256: 687ca1fc371821b50cd80fcdbdd8d611c68dbd51c5e6e03f798accfc82960812
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as 'Pdf.Exploit.Agent-36128'. Embedded JavaScript streams were extracted, indicating an attempt to execute code. The JavaScript appears to be heavily obfuscated but is designed to exploit a vulnerability and likely download a secondary payload, consistent with a dropper or exploit kit stage.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
bcee92b6c53b78992d329508f11628fc4bdcfc71fd32f3222b42a485d9002153		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 45305 bytes
javascript_obj0008_001.js
e35e1ec7d0eebe0b22adef280ac842047c1bceb1e2e121ac17459aee0fa62907		 pdf-javascript-stream PDF /JS object 8 at offset 0x20A 45555 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36128
Obfuscation or payload: unlikely
legacy_pdfkit_stage_000.js
242858f25e5266bde4a0afcd02e4481df42d6d0b63894aaced6156a848f92a4d		 deobfuscated-js double percent-decoded annotation JavaScript at offset 0x1E7 33047 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.