Malicious PDF — malware analysis report

Static analysis result for SHA-256 78d754e1741c0eac…

MALICIOUS

PDF

3.2 KB
MD5: b415aba808c2329fc2c2d8ced00d07a6 SHA-1: fea0c343799b314eb6adcf5ea17a966e4e806ed6 SHA-256: 78d754e1741c0eac43dffde03e2ac69a7e11c7cb8c0fa931043bcc3fab42521f
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was detected by ClamAV as Pdf.Exploit.Agent-36121, indicating it contains an exploit. Static analysis revealed embedded JavaScript, which is commonly used in malicious PDFs to deliver second-stage payloads or exploit vulnerabilities. The presence of JavaScript and the ClamAV detection strongly suggest an exploit attempt.

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
2520a7539e1304977349e8d65ce62c3bb4918b76c5c56b846747fec763f27b05		 pdf-javascript-stream PDF /JS object 7 at offset 0x9C2 468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.