Malicious PDF — malware analysis report

Static analysis result for SHA-256 76d89b4db0aeb410…

MALICIOUS

PDF

5.5 KB
MD5: db33b65f04c39d790feeb6e450cd7301 SHA-1: 38f350c069ed17739757a76dde8c049930a6ce27 SHA-256: 76d89b4db0aeb410f6311076d1f550a077948e96e7172cd0da3e631bd1f89321
254 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript that is obfuscated but appears to be designed to decode and execute a secondary payload. The critical heuristic firings for PDF JavaScript exploit and ML classification, along with ClamAV detection, strongly indicate malicious intent. The JavaScript's obfuscated nature and its role in executing further code are key indicators of a downloader or dropper functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 10

  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • ClamAV: Win.Trojan.Agent-36103 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36103
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
784a3219af11daf98cf784bdaa900f32438c4c8b6061e0866e5c359d349d6031		 pdf-javascript-stream PDF /JS object 12 at offset 0xC08 8389 bytes
Detection
ClamAV: Win.Trojan.Agent-36103
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.