Malicious PDF — malware analysis report

Static analysis result for SHA-256 868241ece5c2ed7f…

MALICIOUS

PDF

244.6 KB
MD5: c85cdb0ace9d96bd9fd7b6330a998587 SHA-1: 3ac7783ddf4bb8a7672a63432db4ba72cc0bf9c5 SHA-256: 868241ece5c2ed7fa3e7b7070bb5e789aac501a66528399df2cce4a5b4e2f960
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is identified as malicious by both a machine learning classifier and ClamAV, which specifically flags it as 'Pdf.Dropper.Agent-7279051-0'. The document body contains seemingly random byte sequences, suggesting it is not intended for direct user interaction but rather to exploit vulnerabilities or execute embedded code. The primary attack pattern is likely a malicious PDF dropper designed to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9594

Heuristics 1

  • ClamAV: Pdf.Dropper.Agent-7279051-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7279051-0