PDF malware analysis — malicious · 6ed8a68a6706f198

MALICIOUS

PDF

63.1 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via ubst)

MD5: 6fccf64a644b6608f67163f0c1db768b SHA-1: 96048bc040f8836c854f8d519cb2ecec11388d84 SHA-256: 6ed8a68a6706f1980556b42553d6f6c74ada64cb45d48d6ce07f9ea70c640b03

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains embedded JavaScript that is heavily obfuscated but appears to be designed to download and execute a secondary payload. The JavaScript's obfuscation and the nature of the detection suggest a dropper or exploit loader.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `fb0abb9248a6b9685f998ace8a540c1a0d00b31959c6b359972314d64e51c883`	pdf-javascript-stream	PDF /JS object 76 at offset 0x99B	54087 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.