Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f5595733f323904…

MALICIOUS

PDF

22.5 KB Created: 2009-10-22 17:27:05 +04:00 Authoring application: formTookYou (via f8580959e35cb0934479bb007fb241c2)
MD5: c299eb40e26f9fc9c40212a852b6e73a SHA-1: 2a578e59940eea27676a37026edd261ef37af8a0 SHA-256: 8f5595733f323904dd99129dfe7588b5a8234c458bcea5618967fc890ff7bbfe
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The file was flagged by ML classifiers and ClamAV as malicious, specifically identified as 'Pdf.Dropper.Agent-7282137-0'. It contains embedded JavaScript, indicating an attempt to execute code. The presence of JavaScript actions and streams strongly suggests the PDF is designed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7282137-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7282137-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0014_000.js
48e0207b14355254d9951842186ca6b6c8b74ddd7919617974b93e44b74bbc46		 pdf-javascript-stream PDF /JS object 14 at offset 0x2448 11768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.