PDF / .SWA malware analysis — malicious · 90edbdadd1dd9f34

MALICIOUS

PDF / .SWA

6.6 KB Created: 2010-09-03 08:30:58 Authoring application: Wigejobawaqivlirore (via f5044Loxidakeneveb)

MD5: 3701d3bf97ac02fa2e7a3414d5010534 SHA-1: df211d4e944255c0ec56c9106dd195707cd31d7a SHA-256: 90edbdadd1dd9f34a458942629362ef25d572460f95a85844366cb46bcb4db4f

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The critical ClamAV heuristic 'Heuristics.PDF.ObfuscatedNameObject' and the 'PDF_PAGE_WORD_XOR_EVAL_STAGER' heuristic indicate that this PDF is designed to execute obfuscated JavaScript. The embedded JavaScript stream, though truncated, likely serves as a stager to download and execute a secondary payload. The PDF's metadata suggests it was authored by 'Wigejobawaqivlirore', which may be a custom obfuscation or packing tool.

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `f41461c6d0ad7c5b3366f5afcb8bd0df9b874c9b0f5ff46847255e6ad0726ba1`	pdf-javascript-stream	PDF /JS object 10 at offset 0x11A1	1999 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.