Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b06b109084c09a0…

MALICIOUS

PDF

9.2 KB
MD5: 5c98ea6cb5d8f9e9e5f51658e5f5fb66 SHA-1: 9cd4dacd249b1bd86f1c58165f9178bfa0996f43 SHA-256: 9b06b109084c09a0d2f90e924b5b07f50e595c7fcac650018b58bc0ca2ec4094
68 Risk Score

Malware Insights

MITRE ATT&CK
T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

The PDF file was flagged by ClamAV with a critical heuristic indicating it is obfuscated, a common technique for malware delivery. The embedded file heuristic further suggests that this PDF is acting as a container for malicious content. The exact nature of the embedded payload is not discernible from the provided evidence, but the obfuscation and embedding point towards an exploit attempt.

Heuristics 2

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload