PDF malware analysis — malicious · 9c076dec66f53b92

MALICIOUS

PDF

16.2 KB Created: 2010-03-05 15:19:50 Authoring application: Laxiwoveja

MD5: f4cdb4bfb26099a909a66d8ba3e09438 SHA-1: c7f966b723280a02723cf866ba5f41e0da257029 SHA-256: 9c076dec66f53b9224893ccd78eef5bbac4e0a8ff5d16bcf3890e38f4ccc3b90

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file was identified as malicious by a ClamAV signature (Pdf.Exploit.Agent-36066) and an ML classifier. Embedded JavaScript actions and streams indicate the presence of exploit code within the PDF. The primary attack pattern involves leveraging these embedded scripts to execute malicious actions, likely leading to the download or execution of a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36066 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36066
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0022_000.js` `22e7b9b95199cc294a88baec03e968aa698abb89fdbf202e98b946c7b2639771`	pdf-javascript-stream	PDF /JS object 22 at offset 0x30AF	971255 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.