PDF malware analysis — malicious · 86a96ec03ba8242c

MALICIOUS

PDF

10.1 KB

MD5: a1ddc9ebe19a3d43ec25889085ad3ed8 SHA-1: 0fa681a24df1b6ee6960bf1098af9689cfb8a576 SHA-256: 86a96ec03ba8242c1486456d67ee17f919128754846dbb3bdf5e836059091dba

286 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1204.002 Malicious File

The PDF contains JavaScript that utilizes the exportDataObject and nLaunch functions to automatically launch an embedded file named 'eicar-dropper.doc' upon opening. This behavior is indicative of a dropper mechanism, designed to execute a secondary payload. The embedded file itself is detected as a dropper by ClamAV.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 8

exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER

PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment.
ClamAV: Pdf.Dropper.Agent-6299400-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-6299400-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`eicar-dropper.doc` `eb0ae2d1cd318dc1adb970352e84361f9b194ff14f45b0186e4ed6696900394a`	pdf-embedded-file	PDF EmbeddedFile object 8 at offset 0x3E0	31744 bytes
Detection ClamAV: Doc.Dropper.Agent-1540415 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`javascript_obj0009_000.js` `a5be9c6113e4547c52c62b50fbcf707b392d0560f3f2c1b6e486be27b1dd0020`	pdf-javascript-stream	PDF /JS object 9 at offset 0x26EF	66 bytes
`javascript_obj0009_001.js` `009d97c59a3a7a22f7c36e7823c3119416d2c20b70ad3559b2c4678dffe73039`	pdf-javascript-stream	PDF /JS object 9 at offset 0x26EF	64 bytes
`combined_document_js_000.js` `5d8953bc4649c23802d326b41f68676eb412c9d671c73f753d394c915d96e2f5`	deobfuscated-js	combined document JavaScript streams at offset 0x26EF	131 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.