Malicious PDF — malware analysis report

Static analysis result for SHA-256 80e73efbeda310ab…

MALICIOUS

PDF

8.9 KB
MD5: 2bfb5d820fafee0dd045f5ba5ade1805 SHA-1: d5c23693c30b854fc965904686e2eb1a57678053 SHA-256: 80e73efbeda310ab1457003e2a5f9508b2bba524e746cf852d121ddc1150158a
228 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF file was flagged as malicious by ClamAV with the signature Pdf.Exploit.Agent-36318, indicating it contains an exploit. The presence of PDF_EVAL and PDF_EMBEDDED_SCRIPT_PAYLOAD heuristics further supports the exploitation of PDF vulnerabilities. The ML classifier also strongly indicated maliciousness. The embedded artifacts suggest the delivery of a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9939

Heuristics 7

  • ClamAV: Pdf.Exploit.Agent-36318 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36318
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/1.0/
    • http://www.xfa.org/schema/xfa-template/2.5/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0008.bin
04462f810d6eacdacecc9d0a5f3f81bebc722af4415e04da19b520338f642b51		 pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x1AB 67 bytes
embedded_file_obj0009.bin
6b2260d3c78649345d3f0b850b831d545d33bb7017ccdf438cdfe1e9db7f2db2		 pdf-embedded-file PDF EmbeddedFile object 9 at offset 0x238 294 bytes
embedded_file_obj0010.bin
499b643519c44bef09c81537aee2b331fee2bcda8e9e8d3d9bcd2246fbefd589		 pdf-embedded-file PDF EmbeddedFile object 10 at offset 0x3A9 613 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36318
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.