Win.Trojan.Agent-36100 — PDF malware analysis

Static analysis result for SHA-256 7b6f163018badebe…

MALICIOUS

PDF

27.6 KB
MD5: 5cdf335a3da8da79535d930afc5caa07 SHA-1: a8d7d6c63de17a63323d6535c5d5fc5ff55a2050 SHA-256: 7b6f163018badebeacae261796f83f834a70f6399d1cfcfce95ad1822e10f47e
166 Risk Score

Malware Insights

Win.Trojan.Agent-36100 · confidence 95%

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as Win.Trojan.Agent-36100. Embedded JavaScript streams were found, indicating the likely execution of malicious code. The JavaScript appears to be heavily obfuscated, but its presence and the overall classification strongly suggest it's designed to download and execute a secondary payload, aligning with the identified malware family.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Win.Trojan.Agent-36100 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36100
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
0e6dea878b4ecb22e55e7680b1f9aac7093cb78ea0d0b3e3871f359d72dd80cd		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 27525 bytes
Detection
ClamAV: Win.Trojan.Agent-36100
Obfuscation or payload: unlikely
javascript_obj0008_001.js
8fa512f1cb64c64af18394f6510ad3170f97564186c4467879e70629aa7792f3		 pdf-javascript-stream PDF /JS object 8 at offset 0x20A 27775 bytes
Detection
ClamAV: Win.Trojan.Agent-36100
Obfuscation or payload: unlikely
legacy_pdfkit_stage_000.js
577dddcec919cc8490e7bf2b59a539bac4a9daf4bc10baf324703a20e027e823		 deobfuscated-js double percent-decoded annotation JavaScript at offset 0x1E7 15141 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.