Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c345be340354b76…

MALICIOUS

PDF

97.3 KB
MD5: 2600d6f36f719bfa6061b34afce1f3be SHA-1: e3ef6523db12fedada179c73389b5b3edce9aa11 SHA-256: 7c345be340354b76c1feefde8e2fdd88e6b4c2ec88d728b8a52b1d01598b0488
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by multiple high-confidence heuristics, including ML classification and ClamAV detection, indicating it contains malicious content. The presence of an embedded script payload and XFA form suggests an exploit attempt. The embedded script is likely responsible for downloading and executing a second-stage payload, though its exact functionality is obscured by the PDF structure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-6136306-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-6136306-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0000026c.bin
f4a9b061fef2df3a239d93c83d8db5e92e2bef7206f45ae90d3435442f5e5b7e		 pdf-embedded-script PDF raw stream script payload at offset 0x26C 98873 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.