Malicious PDF — malware analysis report

Static analysis result for SHA-256 6930c3ff3099ead2…

MALICIOUS

PDF

45.0 KB
MD5: e7d1b461433310d536111b7ef6737699 SHA-1: 32a857f6b5a5c1f878d63fdcf4c255aef52ff832 SHA-256: 6930c3ff3099ead231a122a627653cee9353a4bc5fc69e0e5fa91d5bcfdc49ed
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and ClamAV as malicious (Pdf.Exploit.Agent-36128). The JavaScript appears to be heavily obfuscated but is designed to execute an exploit. This execution likely leads to the download and execution of a second-stage payload, a common technique for malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
bab23db3d444e6a7bfaae33132b59c79f3385d30f10d0e52442ad23dd74f802d		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 45305 bytes
javascript_obj0008_001.js
a50340fd96179c03a75e73b995f7ddb5fd99862ef68865bdda4fa685acfad972		 pdf-javascript-stream PDF /JS object 8 at offset 0x20A 45555 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36128
Obfuscation or payload: unlikely
legacy_pdfkit_stage_000.js
8a4983eb6ceec730e3dbc6752ff5c07b886fca0208401b0b398463a2ecc69e9c		 deobfuscated-js double percent-decoded annotation JavaScript at offset 0x1E7 33047 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.