Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ac8f4c80ce2a18f…

MALICIOUS

PDF

12.8 KB
MD5: b169dfe7823868c23c1136ecf4b5b29d SHA-1: 2a0e621a5d0d1a7d468e8220066b0e557b7a2c8f SHA-256: 9ac8f4c80ce2a18f889ce9383e5df36a1372e840c4bb6ba796ecbdd6e7565094
106 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged as malicious by multiple heuristics, including a high-confidence ML classifier and ClamAV detection as 'Win.Trojan.Agent-36281'. It contains embedded JavaScript, indicating an attempt to execute malicious code. The primary attack vector appears to be exploiting PDF vulnerabilities to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Win.Trojan.Agent-36281 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36281
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
15ea8b352cb63d9b5bf986cf09122be4da0aa33b0917ea1ddb51d7912cc0bc12		 pdf-javascript-stream PDF /JS object 76 at offset 0x369 12006 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.