Malicious PDF — malware analysis report

Static analysis result for SHA-256 965dc129546c5759…

MALICIOUS

PDF

24.3 KB Created: 2009-10-28 21:43:57 +03:00 Authoring application: pageDolor (via acb5d1120b8a0b8d3d97905ba9a72dc4)
MD5: 716d1df40f2d93802df98ad48749228b SHA-1: 9fd184961898eaa81599c38710896a1f698149d0 SHA-256: 965dc129546c57590fa4d26dca389217095a9c7193f7e31064dcad3d13cb177c
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1204.002 Malicious File

The file is a PDF containing embedded JavaScript, as indicated by multiple heuristic firings and the presence of a javascript_obj0018_000.js artifact. The ClamAV detection 'Pdf.Dropper.Agent-7284487-0' strongly suggests this JavaScript is malicious. The likely intent is to download and execute a secondary payload, a common dropper behavior.

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7284487-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7284487-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0018_000.js
6d894d5e7d68af775d19f1c1e2c6d101c0c9dd4c68883892a5c3a5122d9f14ef		 pdf-javascript-stream PDF /JS object 18 at offset 0x3245 10108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.