PDF malware analysis — malicious · 98048aa5dd643b40

MALICIOUS

PDF

22.3 KB Created: 2009-04-24 09:54:29 +02:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 7.0.5 (Windows))

MD5: 4ca6e7b96dfa79593d196001ccc58c2d SHA-1: 89bb721f87c026e3f920f8efb800a6f11a9749ad SHA-256: 98048aa5dd643b40ec3f819048eae387923154e0215b5d9c06f2fd42454e1468

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains obfuscated JavaScript, indicated by multiple heuristic firings related to PDF JavaScript. The JavaScript appears to be designed to execute malicious code, as suggested by the 'eval' calls and string concatenations used to construct commands. The specific intent of the script is unclear due to heavy obfuscation, but it is likely to download and execute a second-stage payload or perform other malicious actions.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.