Malicious PDF — malware analysis report

Static analysis result for SHA-256 736fc8122ed8248f…

MALICIOUS

PDF

82.8 KB Created: 2010-03-17 12:45:11 +01:00
MD5: 3e50774ca5d9377a7a7c65b15eca3adb SHA-1: 52ca4782cb05a3d756f214b3793d2304e8bcb7d0 SHA-256: 736fc8122ed8248f0b768989fce19990b188d406e716cc44fe8e6c8ff74dabd9
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV with the signature Win.Trojan.Java-6. It contains an embedded file, which is likely the payload. The PDF structure indicates it's an image-only lure, suggesting the embedded content is the primary focus for malicious activity. The presence of an embedded Java payload points towards a spearphishing attachment attack vector.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3458

Heuristics 4

  • ClamAV: Win.Trojan.Java-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Java-6
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
Java.ClassLoader.24564.jar.bz2.bz2.bz2.bz2.bz2.bz2.bz2
008458049d1797adafb337e810c1ebfb0f21b10b348816b01321d0dbe8b3632b		 pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x1052F 17226 bytes
Detection
ClamAV: Win.Trojan.Java-6
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.