MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1559.002 Component Object Model Hijacking
T1204.002 Malicious File
The sample is a PDF file flagged by ClamAV as 'Pdf.Exploit.Agent-35955'. Static analysis detected embedded JavaScript and RichMedia (Flash) content, indicating an attempt to exploit vulnerabilities within the PDF reader. The embedded 'WpuVlEGnF.swf' file is likely the exploit payload. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9859
Heuristics 6
-
ClamAV: Pdf.Exploit.Agent-35955 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Exploit.Agent-35955
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
RichMedia (Flash) high PDF_RICHMEDIAPDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded file low PDF_EMBEDDEDPDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
WpuVlEGnF.swfbf9dea6ff47dfb47c2f51b1fa9a09527dfe5e95399ccb2d043ba956b197360c9 |
pdf-embedded-file | PDF EmbeddedFile object 16 at offset 0x234BB | 52647 bytes |
|
Detection
ClamAV:
Pdf.Exploit.Agent-35955
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.