PDF malware analysis — malicious · 71d3cc7c906017d4

MALICIOUS

PDF

59.4 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: Acrobat PDFMaker 7.0.5 for PowerPoint (via ubst)

MD5: 673cc89b36cd687af3e9b080f2d32eae SHA-1: b33646a6ac104d6ae06ce0ad2e837e1c9f0d03b0 SHA-256: 71d3cc7c906017d41c6901a57df3d185429df3a811a0d5526ab0e874689c4c1c

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, flagged by multiple heuristics and a machine learning classifier. The ClamAV detection 'Pdf.Exploit.Dropped-94' strongly indicates malicious intent, likely involving the execution of a dropped payload. The JavaScript code is heavily obfuscated but appears to be responsible for downloading and executing this payload, aligning with common exploit document techniques.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `74d9f8d73556bcc72e33b71768ffa4115b3a94fb1e5ac501c1c91da3573f3fa5`	pdf-javascript-stream	PDF /JS object 76 at offset 0x99A	50785 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.