Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a6523c32c239161…

MALICIOUS

PDF

45.0 KB
MD5: 62d7ce8a9248fa768be78c87a15ddfc1 SHA-1: e4eb0ecbedf531460f23bc74ac00708849cbc10d SHA-256: 8a6523c32c2391616f603808722829ab5bbb43d277b8cf6333b945059407b956
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript

The PDF file contains embedded and obfuscated JavaScript, as indicated by multiple heuristic firings. This script is likely designed to exploit vulnerabilities in PDF rendering engines, potentially leading to arbitrary code execution. The presence of XFA form elements further suggests a complex document structure often used for exploitation. While the specific payload is not clear due to obfuscation, the overall pattern points to a malicious PDF designed for exploitation.

Heuristics 5

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
6151c5a606466481fa786b60aa9fd91c2e0b1648fc69e6da233c64c5ed4f5070		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1F8 3379 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.