PDF malware analysis — malicious · 746485466a0086a0

MALICIOUS

PDF

45.0 KB

MD5: 3f5c8cc5f7c49e7bf7b27954ba599094 SHA-1: 31556b8625db293678823239120e09c27e1ba302 SHA-256: 746485466a0086a047e148d0eda5a9b6d9629716e1dc2c761d1834ae6b71d323

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is a PDF file flagged as malicious by ClamAV and an ML classifier. Embedded JavaScript streams were extracted, indicating an attempt to exploit a vulnerability for client execution. The JavaScript code appears to be obfuscated but likely serves to download and execute a secondary payload, consistent with a downloader or dropper malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0008_000.js` `b6fbcd70f56d7b4b2d51c8868c648053b6f6413a41c3b231d35ada8d244d7181`	pdf-javascript-stream	PDF /JS object 8 at offset 0x1E7	45305 bytes
`javascript_obj0008_001.js` `78ea2984976e522f2a9b8248bc6e309e22c3ed159eefa299338c62d6150ea715`	pdf-javascript-stream	PDF /JS object 8 at offset 0x20A	45555 bytes
Detection ClamAV: Pdf.Exploit.Agent-36128 Obfuscation or payload: unlikely
`legacy_pdfkit_stage_000.js` `53b723d9483daab43d35062900556fbde82e3e19941b0e1df4d9d4660c497d9b`	deobfuscated-js	double percent-decoded annotation JavaScript at offset 0x1E7	33047 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.