Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c7f4351f88d3a46…

MALICIOUS

PDF

9.0 KB Created: 2009-02-19 14:45:49 -02:00 Authoring application: Writer (via OpenOffice.org 3.0)
MD5: e1bb139fc633b61671836a193f83567c SHA-1: 79e78d5ca9602c7f0170148b3cd16847bea9e9da SHA-256: 8c7f4351f88d3a468be1c3528c1ccf07138a8a2893d53d6d0b56045aa3423585
130 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious File

The PDF file was flagged by ClamAV as Pdf.Exploit.Agent-35541 and a machine learning classifier indicated a high probability of maliciousness. A PDF launch action was detected, suggesting an attempt to exploit a vulnerability within the PDF reader to execute arbitrary code. No document body text or scripts were available for further analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9770

Heuristics 2

  • ClamAV: Pdf.Exploit.Agent-35541 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35541
  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous