Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fca8e55fb5ac3b1…

MALICIOUS

PDF

8.1 KB Created: 2009-12-05 00:02:09 +03:00
MD5: 77e48454e6289ba15a931c0cf55afc7b SHA-1: 334f0a0c2df899e9d765b0ffc1bb99c0dfcd1cd3 SHA-256: 6fca8e55fb5ac3b1f1aab700aa714f10dffcea420aacc8798f9549e41571ce3c
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF sample contains JavaScript that utilizes unescape and eval functions, indicating an attempt to obfuscate and execute malicious code. Heuristics strongly suggest a PDF JavaScript exploit cluster, and ClamAV identifies it as Pdf.Exploit.Agent-4447. The embedded JavaScript attempts to retrieve and execute content from a field value, likely a URL, which is characteristic of a downloader or initial-stage exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 9

  • U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high CVE related PDF_U3D_CVE_RELATED
    PDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Pdf.Exploit.Agent-4447 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-4447
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • unescape() call high PDF_UNESCAPE
    unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0022_000.js
6cca8c8c5e3b9a9ec093f40e8f41955991f38bbc34c535e28ebfef7d00294c5c		 pdf-javascript-stream PDF /JS object 22 at offset 0x1E34 45 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
objstm_0029_00.bin
6a13b2570f030046d300c9a71fdd86416f874348e36deacc261aaceffac980f1		 pdf-objstm-decoded PDF /ObjStm 29 0 obj (inflated) 200 bytes
u3d_00_off00001c63.bin
e29cd62c2da6c352128680576917c23ab7afe0c651296174d6d96b8e1e6dfa41		 pdf-3d-stream PDF U3D 3D stream at offset 0x1C63 356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.