Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fd5681556975a01…

MALICIOUS

PDF

100.7 KB
MD5: bafbb745fac127441ae0e0b57b732df6 SHA-1: d17feaf6c99bc47e77831183b9b3355edf71ebfa SHA-256: 9fd5681556975a01d6b503c9d7d735c9486c43a110ea29db8599ec498764713f
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF utilizes XFA forms, a known vector for exploitation. A high-confidence ML classifier and ClamAV detection confirm its malicious nature. An embedded script payload was identified, likely responsible for delivering the exploit. The specific script content was too obfuscated to determine its exact function, but it is presumed to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-6136306-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-6136306-0
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/2.5/
    • http://www.xfa.org/schema/xfa-data/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00000246.bin
d605c1602f613bb3e5c5d5e959c1b9c6c8e8e416fb069dcaa4d2fa39d3f58d29		 pdf-embedded-script PDF raw stream script payload at offset 0x246 102374 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.