PDF malware analysis — malicious · 69e16a3440fbf4e8

MALICIOUS

PDF

6.6 KB Authoring application: Tisilarehaue (via c2882Tibedegabala)

MD5: cd07482d3a4c368adc85799ac4f91a91 SHA-1: de1c49a86ada6ba03dbc6c22b8c0c54cb603aaa2 SHA-256: 69e16a3440fbf4e8792785f72ab85594b7309a5c2bd986dba80cfd3a12332d86

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that is obfuscated but appears to be designed to decode and execute a second-stage payload. The script uses string concatenation and character code manipulation to construct its malicious commands. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to exploit delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36142 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36142
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `d4dce4f95f7146e3b127d68edf45ceb045483a205d9e9a2a53d6e6b80d83b663`	pdf-javascript-stream	PDF /JS object 10 at offset 0x1230	1728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.