PDF malware analysis — malicious · 9f49b2152040c3f9

MALICIOUS

PDF

621.8 KB

MD5: caa51e7eb41e5c3bb3bc6cda51a0af30 SHA-1: 421ea552d1e4389716196964c8e3b6a69aed697c SHA-256: 9f49b2152040c3f9c11604e325b03b91e80abbf5511d067728eac98c5e0e2d28

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, which identified it as 'Pdf.Dropper.Agent-7287680-0'. Heuristics indicate the presence of embedded JavaScript, including the use of `unescape()` for obfuscation. This suggests the script is designed to download and execute a second-stage payload. No specific family could be identified.

Machine Learning

Nyx PDF Classifier malicious score 0.9492

Heuristics 5

ClamAV: Pdf.Dropper.Agent-7287680-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7287680-0
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits (matched inside decoded stream)
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 18

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0321_001.js` `86337aedb15a1ff0a56ae9689d96a30cdb342693e5fe9bd8ddceeca2e2b308e3`	pdf-javascript-stream	PDF /JS object 321 at offset 0x91473	2202 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
`icc_00_off00016f60.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x16F60	3144 bytes
`font_00_cff_off0000438c.bin` `cf4944c56c01f4a65c36b5010c12128ca3ddbe0e6806e8b147a7b04453bfa751`	pdf-font-stream	PDF embedded font (cff) at offset 0x438C	6612 bytes
`font_01_cff_off0000eba6.bin` `38f4ddd32e736897982ced0858b49da07a104e846d0946b9789f4ef370f99eb2`	pdf-font-stream	PDF embedded font (cff) at offset 0xEBA6	357 bytes
`font_02_cff_off0000f04f.bin` `2789af23995f8af33b2dae091e9b962494e0b8b0e898fada623820ee9686b3ca`	pdf-font-stream	PDF embedded font (cff) at offset 0xF04F	499 bytes
`font_03_cff_off0000f57c.bin` `755b31802bfcbe5da85fa3b6417005821fa046390579475e59a1b7e221fd17f2`	pdf-font-stream	PDF embedded font (cff) at offset 0xF57C	2550 bytes
`font_04_cff_off000102ca.bin` `eb7fc9a0f6b5c973d758c18668889ef5241421e8108bf894a9400ecd0930c40c`	pdf-font-stream	PDF embedded font (cff) at offset 0x102CA	3369 bytes
`font_05_cff_off00011273.bin` `ce12ce1ce9ee146def1a9a0aa879316c8283c74b0dab40de60412666b768231d`	pdf-font-stream	PDF embedded font (cff) at offset 0x11273	2951 bytes
`font_06_cff_off000120a8.bin` `650743b0083f4117eafe6d934f210cd07b94d118b25ed99f041916d1b6f42ac7`	pdf-font-stream	PDF embedded font (cff) at offset 0x120A8	5979 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.40, consistent with packed or encrypted content.
`font_07_cff_off00013928.bin` `91487fd16b17d83908b1ba219ae597731b7158e968667787a056b1d4df0de59a`	pdf-font-stream	PDF embedded font (cff) at offset 0x13928	1949 bytes
`font_09_cff_off0001615c.bin` `c5675bd2f2b586cbf48ee24f95e1cf91eec1b4928c28c92220efce9ec4db3e29`	pdf-font-stream	PDF embedded font (cff) at offset 0x1615C	3996 bytes
`font_10_sfnt_off000197e2.bin` `2722878b19761e7a433e1ca6f32e7f9fe9cccce4136877b3beb9040f23bd4b18`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x197E2	23432 bytes
`font_11_sfnt_off0001cdb9.bin` `80383e85181b7288bd3f68d71356b7e2ef2e1f0ba00d93e81908469c104a18d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1CDB9	52108 bytes
`font_12_sfnt_off000254a1.bin` `336a7a084a76c025a84d5a8cbd6080db9a267cde0e24fe672acabed56b19aa8d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x254A1	48764 bytes
`font_13_cff_off000896fd.bin` `b7acc2e77938f52ea0e0e99ad276600cacf4c9a68f9966b0cff658984fc5fdfe`	pdf-font-stream	PDF embedded font (cff) at offset 0x896FD	1390 bytes
`font_17_cff_off0008e561.bin` `498107d4b463cdfaabb7ecb0de303a1fd3753cd0475826d8151726b62a86cbb1`	pdf-font-stream	PDF embedded font (cff) at offset 0x8E561	2026 bytes
`font_18_cff_off0008f088.bin` `6b20e84459271e0cdfae9863860320d5b0fe24a40f52c5aa56fd600bf142e820`	pdf-font-stream	PDF embedded font (cff) at offset 0x8F088	1370 bytes
`font_22_cff_off00093d8c.bin` `fbf22266dae0292a560fe4992b55ae8d9a60e5393b8105c8e8d7d4434902074f`	pdf-font-stream	PDF embedded font (cff) at offset 0x93D8C	1230 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.