Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ac842968e846d9e…

MALICIOUS

PDF

47.6 KB
MD5: 39a2eabb0388b982ca26f2543965e37a SHA-1: d054afc3a8f14d356e99c7155929a8c98a807ce2 SHA-256: 9ac842968e846d9e31cd2042211c58d6995a64f139549eee825f0243bf214851
106 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1204.002 Malicious File: User Execution: Malicious Attachment

The PDF file was flagged by multiple heuristics, including a high-severity ML classifier and ClamAV detection as 'Pdf.Dropper.Agent-7285956-0'. The presence of JavaScript actions and embedded JS streams indicates the file is likely designed to execute malicious code, commonly used to download and run a secondary stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7285956-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7285956-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.