PDF malware analysis — malicious · 9e249cc6ed8c2c89

MALICIOUS

PDF

7.5 KB Authoring application: Jgaxivakafowizasi (via 9ca09Uohosicilab)

MD5: 2be54fe15a66e0e876f847e5f85b4483 SHA-1: 24f6fbb6a0f26888cc2a60f39f6d169dbdad2531 SHA-256: 9e249cc6ed8c2c898a754bd0954fbe4b48c126714b0309870d165ace29606a31

108 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ClamAV's 'Heuristics.PDF.ObfuscatedNameObject' and a high-confidence ML classifier, indicating malicious intent. Embedded JavaScript actions and streams were detected, suggesting the document is designed to execute code. The obfuscated nature of the JavaScript and the PDF structure points towards a downloader or exploit delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `c35f939b8b08b4458e4f2307d4bfd0afc23546c955e11c1da88e87302e40c9b0`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1358	3029 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.