Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aac239c879bdb6d…

MALICIOUS

PDF

4.1 KB Created: 2010-04-14 12:42:52 +02:00 Authoring application: PDFCreator Version 0.9.5 (via GPL Ghostscript 8.61)
MD5: f1aef1b24e199e9a51a56108e8e39ac3 SHA-1: d0deb64be5a9b84f1c667eee25b2ca701ec34d65 SHA-256: 9aac239c879bdb6dac134810261f02c11807ce3f2ce46b877376d9d0ab600d04
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript T1559.001 Component Object Model Hijacking

The critical ClamAV detection and ML classifier strongly indicate maliciousness. PDF heuristics reveal embedded JavaScript and the use of ASCIIHexDecode and ASCII85Decode filters, common in PDF exploits. The ML_NYX_PDF_MALICIOUS score of 0.999769 further supports this. The primary attack vector appears to be a PDF exploit leveraging JavaScript to deliver a payload, as indicated by the ClamAV signature 'Pdf.Exploit.Agent-22110'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • ClamAV: Pdf.Exploit.Agent-22110 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-22110
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Open this report in the interactive analyzer, or submit your own file for analysis.