Malicious PDF — malware analysis report

Static analysis result for SHA-256 709f064b987e7066…

MALICIOUS

PDF

54.2 KB
MD5: 3ce1d27b4189b4bddec816d2cb279199 SHA-1: 61af22b1a7a46b4d9f92ac04f12d74d23149f000 SHA-256: 709f064b987e7066229c496434058b1aa4f2757bfe2c1cbd86a6281b1dae7f2b
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, indicating an attempt to execute malicious code upon opening. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to download and execute a second-stage payload. The presence of JavaScript points to T1059.007, and the overall execution of a payload suggests T1203. Given it's a PDF, T1566.001 is a likely initial access vector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7271374-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7271374-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.