PDF malware analysis — malicious · 9587a7ef8447273b

MALICIOUS

PDF

4.7 KB Created: 2010-04-30 06:08:55 Authoring application: Liqejocomiheka

MD5: a1a490befed1cc7306f8cab0295f6916 SHA-1: 0332a8b97e8faaaef56b5de6cc535fbde25f6f39 SHA-256: 9587a7ef8447273ba5e07c16acf582c2dd6c4129d3c243584dc00e52fcecff06

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a high-severity ML classifier and critical ClamAV detection for 'Pdf.Dropper.Agent-7284233-0'. Embedded JavaScript was detected, indicating the likely execution of a malicious payload. The ML classifier's high confidence score supports the assessment of a malicious dropper.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7284233-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7284233-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `66b487b6058426c3182f61ab640a03646d06823ab497da9c02f6303d3260eb25`	pdf-javascript-stream	PDF /JS object 11 at offset 0xD06	935 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.