PDF malware analysis — malicious · 9c9ae59783314bcc

MALICIOUS

PDF

6.3 KB

MD5: 8bafc4f0ceaf79ab64615b93ba7a86f9 SHA-1: 6dff3f21af9145b8d3d96f47d53167c38c8934b1 SHA-256: 9c9ae59783314bccc67cfd21236cb456eef42d243b4d87bca2c7d80cc2188bd7

98 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment

The critical ClamAV detection and the PDF_FILTER_HEX heuristic indicate this PDF is designed to exploit a vulnerability. The embedded file further suggests it's a dropper for a secondary payload. The PDF structure itself is obfuscated, as indicated by the differential parser failure.

Heuristics 5

ClamAV: Pdf.Exploit.Dropped-90 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-90
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `98698960e94d0b330c16c151b14d7c7278e993d486a92aceff73bb2d37642ce4`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x5A	1775 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.