PDF malware analysis — malicious · 7da8a98819218cd3

MALICIOUS

PDF

3.2 KB

MD5: 5d81ed9bad2fb664239fc13b7c8890e2 SHA-1: 04f2fcbc23b73be393da22598b791a99270121ab SHA-256: 7da8a98819218cd3ae3a2fe856cf0e687c4a2d1edf5ecc77dd0de5963fc29cbe

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection 'Pdf.Exploit.Agent-36121' strongly suggests this is a known exploit. The embedded JavaScript is the likely mechanism for delivering the exploit payload. No specific IOCs like URLs or hashes were extracted from the script itself, but the ClamAV signature is a high-priority indicator.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36121 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36121
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `6be2776a75c34827d3e6e502bd58eca62a8743454e1ed1ee3b08498e46500b58`	pdf-javascript-stream	PDF /JS object 7 at offset 0x9C8	483 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.