Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cf4f274ef6cf292…

MALICIOUS

PDF

51.3 KB Created: 2009-12-07 16:08:08 +03:00 Authoring application: moreThose (via 327e125136fd2d7d012efe5acf1a1301)
MD5: 63f94a9da079dca8e5dd127565844b2a SHA-1: d538d4e8331c1bcaff5387013722c5a943ae1cac SHA-256: 8cf4f274ef6cf29206aa6aa5a051512576c807ac9ef67e9a984e77fff1a47e1e
124 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. A critical finding is the presence of an eval() call within the decoded JavaScript stream, which is a common technique for executing obfuscated or dynamically generated malicious code. The ClamAV detection of 'Pdf.Dropper.Agent-7281127-0' strongly suggests its role as a dropper, designed to download and execute a second-stage payload. The document body is unreadable, but the technical indicators point to a malicious dropper functionality.

Heuristics 5

  • ClamAV: Pdf.Dropper.Agent-7281127-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7281127-0
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0025_000.js
1aabea9e3638f13096d45fe102396708fdece2951443365c23262fc1837fe57d		 pdf-javascript-stream PDF /JS object 25 at offset 0x38AA 4096 bytes
javascript_obj0026_001.js
a42cffc8299458a4578bbac6807f823b81c358d81f0403c98c7ba8a6a54821f4		 pdf-javascript-stream PDF /JS object 26 at offset 0xC637 41 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.