PDF malware analysis — malicious · 95bdad819f3a0163

MALICIOUS

PDF

2.7 KB

MD5: 0a0c256fe01e1cb3ca6cb03a368e2ba7 SHA-1: 8952052830556f4f7fa304b2d5609aefc33a4524 SHA-256: 95bdad819f3a01637525ef8e17abffa80a3103d01f5048a25f634693c35fab41

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, as indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection further confirms its malicious nature. The embedded JavaScript is likely responsible for executing malicious code, potentially downloading a second-stage payload or performing other harmful actions. No document body text was available for analysis, but the presence of obfuscated JavaScript is a strong indicator of malicious intent.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `a842e11449301d5d1f0b4d2a2cc1d71a5962bef73cfdd286f895732272056a53`	pdf-javascript-stream	PDF /JS object 6 at offset 0x18B	5012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.