PDF malware analysis — malicious · a120408d53b18904

MALICIOUS

PDF

326.2 KB Created: 2015-06-04 23:30:48 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: 75f5a7732131116e0e0ceeadf00b1195 SHA-1: 1157604001f406ace2987552f28599460120038a SHA-256: a120408d53b189040e10ae45237b5af405e5a8fe575829968054bc25253117c1

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file was identified as malicious by ClamAV with the signature Unix.Trojan.PhpBackdoor-9354530-2. Static analysis also revealed an eval() call within the PDF structure, indicating potential code execution. The presence of a PHP backdoor suggests an intent to compromise a web server.

Heuristics 2

ClamAV: Unix.Trojan.PhpBackdoor-9354530-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Unix.Trojan.PhpBackdoor-9354530-2
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000c18f.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xC18F	264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.