PDF / .VXE malware analysis — malicious · 73647f3d6bcdd68d

MALICIOUS

PDF / .VXE

66.4 KB Created: ert Authoring application: Adobe (via asd)

MD5: 8d49f7ef40f1d5d09512fb77a3fdee51 SHA-1: 46c71680fa24778574a7ad7d74c58496df1b6e00 SHA-256: 73647f3d6bcdd68d8004c9be45f32e5899352994313c7b5bb822ec89392c98bb

108 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF sample contains embedded JavaScript, flagged by multiple heuristics and ClamAV as malicious. The JavaScript appears to be obfuscated but is designed to execute code, likely downloading a second-stage payload. The ML classifier also strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Exploit.Agent-20238 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-20238
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `d5a335151de436278ff28669eb53310c71ef56c6d305c8f6ab2e1a31864b4ff0`	pdf-javascript-stream	PDF /JS object 6 at offset 0x1063C	220 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
`stream_001_off000001b8.bin` `8b8dd7bb36910d5d0f5dcde31409e6f0741cb009d1287c2574802a5db4019a4f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1B8	89984 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.