PDF malware analysis — malicious · 9fd67611a7e6479c

MALICIOUS

PDF

7.5 KB Authoring application: Jgaxivakafowizasi (via f8dccUohosicilab)

MD5: c9da6679b54aec01f5efa9ce722a9921 SHA-1: 0cfc62cb7a6b9799dd8b5835b7e21ff538c13a9e SHA-256: 9fd67611a7e6479ce9bb54a52f67414016243fb01e0f259819233e40489cac51

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier and ClamAV also flagged this file as malicious. The presence of JavaScript strongly suggests an attempt to execute arbitrary code, typically for downloading and executing further stages of malware. No specific family could be identified.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `c35f939b8b08b4458e4f2307d4bfd0afc23546c955e11c1da88e87302e40c9b0`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1358	3029 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.