PDF malware analysis — malicious · 9347d93ee8120add

MALICIOUS

PDF

37.8 KB Created: 2010-04-19 21:56:12 +04:00 Authoring application: TCPDF (via TCPDF 4.8.032 (http://www.tcpdf.org))

MD5: 635f1a104ea1cbd9a253b75c01b4fb42 SHA-1: f0e3406960bb150ff73b5ce1372ca2b8d85be588 SHA-256: 9347d93ee8120add92ae45fa4c222bb2b06f7e9d66cc514a3c044121f474a700

84 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript and is flagged by ClamAV as Pdf.Exploit.Agent-23575. The presence of JavaScript actions and embedded JS streams indicates an attempt to leverage PDF vulnerabilities for code execution. The ClamAV detection strongly suggests this is a known exploit, likely used to deliver a secondary payload.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-23575 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-23575
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `b14d1a154972a87ba7973a5cbf148a8ef6e3de5d13280c71e3d37a766e5ba74f`	pdf-javascript-stream	PDF /JS object 10 at offset 0x8CAC	1346 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.