Malicious PDF — malware analysis report

Static analysis result for SHA-256 973c28e6146439b8…

MALICIOUS

PDF

97.0 KB
MD5: a50c7b1dcdbbd6bf5ceccb5dd14b677c SHA-1: 1d0d63d4fbef30370b540889532084e226727129 SHA-256: 973c28e6146439b8634324d072ff02ce80b0fd8d5f45a040c49028250408e0ff
118 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious PDF T1059.001 Command and Scripting Interpreter: PowerShell

The PDF was flagged by multiple high-confidence heuristics, including ML classification and ClamAV detection, indicating it contains malicious content. The presence of an XFA form and an embedded script payload suggests an exploit is being delivered. The embedded script is likely responsible for downloading and executing a second-stage payload, though its exact functionality is obscured by the PDF structure. The benign reputation of the Adobe XDP URL does not negate the malicious nature of the overall file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-6136306-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-6136306-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0000026c.bin
00eff489ed924ad9dfa63ea4ac1d4c7d602b803732f37ae0fd4ce44fccd51bef		 pdf-embedded-script PDF raw stream script payload at offset 0x26C 98657 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.