PDF malware analysis — malicious · 8eaf22bd11400bc3

MALICIOUS

PDF

26.6 KB Created: 2006-02-01 14:14:12 Authoring application: Wegoptyr (via HghTc6Fs)

MD5: 4af7ab2e33135cbedacc3b1d0e62eb26 SHA-1: bd16ce8d91a70626199475ead61148443b6ef659 SHA-256: 8eaf22bd11400bc37cd76aad4bc293fa0774b46b950e29d810656c1b5b59e061

118 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.007 JavaScript

The PDF contains embedded JavaScript, with a critical heuristic firing for 'eval()' usage, indicating obfuscated code execution. The embedded JavaScript attempts to reconstruct strings and execute them, likely to download and run a second-stage payload. The ClamAV detection 'Win.Exploit.JS-58' further supports the malicious nature of the script. No specific family could be identified due to the obfuscation.

Heuristics 5

ClamAV: Win.Exploit.JS-58 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.JS-58
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `7e625c048d1a63dd0b8f9b5485d0f029a518d7eaac0fc39655687d1431b2fc98`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1EE	26117 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
`javascript_obj0007_001.js` `ef3205d9691f872e7f596fb987b4878283d7613c851e1c3d59284c66bf117211`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1EE	360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.