PDF malware analysis — malicious · 79dbce4a546def95

MALICIOUS

PDF

45.0 KB

MD5: fa49bcc79fa1aa78bec182223ab916c3 SHA-1: 7bfec8a8432c0b96bc8ba8cae2d562b002dc7f92 SHA-256: 79dbce4a546def955da0d44cd1b51c64e6fd02d76c646a5ca3dc8a128dc11020

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF file was detected as malicious by ClamAV (Pdf.Exploit.Agent-36128) and flagged by an ML classifier. It contains embedded JavaScript, which is a common technique for exploiting PDF vulnerabilities. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, although the specific actions are obscured.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36128 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36128
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0008_000.js` `4f389b7d4cad05ab78b38cfc0a0cc4224f6c7c1cd18c91b2073bcd163e41906e`	pdf-javascript-stream	PDF /JS object 8 at offset 0x1E7	45305 bytes
`legacy_pdfkit_stage_000.js` `937ce30ba09d3f4b6a0558d9cdab00cf5806dbb19f8da21b906a8baf4d8deee2`	deobfuscated-js	double percent-decoded annotation JavaScript at offset 0x1E7	33047 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.