PDF malware analysis — malicious · 95c55675db6032df

MALICIOUS

PDF

326.2 KB Created: 2017-02-14 06:41:51 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: 184b91a1804680b3500af1aa3e5ffb95 SHA-1: d1271372edbdb1e3fb824b77617f517a9c6692eb SHA-256: 95c55675db6032dff6d7682d50fbb5cf0196ffd19933757210562ffb3f2fe80a

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is a PDF document that triggered a critical ClamAV detection for 'Unix.Trojan.PhpBackdoor-9354530-2'. Additionally, a high-severity heuristic firing for 'PDF_EVAL' indicates the presence of an eval() call, commonly used to execute arbitrary code within PDF files. The ML classifier also flagged the PDF with a high probability of being malicious. These indicators suggest the PDF is designed to exploit a vulnerability and deliver a backdoor.

Machine Learning

Nyx PDF Classifier malicious score 0.9895

Heuristics 2

ClamAV: Unix.Trojan.PhpBackdoor-9354530-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Unix.Trojan.PhpBackdoor-9354530-2
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000c18f.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xC18F	264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.