PDF malware analysis — malicious · a5b3d8b15cb729ef

MALICIOUS

PDF

1.9 KB Authoring application: sli

MD5: 10008785078dc800b038bb19d16720ad SHA-1: 1eae1b05f22bbf99253f8a4fe261d4b4ffc082c8 SHA-256: a5b3d8b15cb729efef5592361e2fa11da29fbe814bbd066733a9b08e3b63e638

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged as malicious by ClamAV with the signature 'Pdf.Exploit.Dropped-91', indicating it exploits a known PDF vulnerability. The presence of embedded JavaScript, further confirmed by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics, strongly suggests that the script is responsible for downloading and executing a second-stage payload. The ML classifier also provided a very high confidence score for maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-91 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-91
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `7d7d0a6d2f5f5b5105963cfa03665e87384169e34f070cc045821a33b2346d29`	pdf-javascript-stream	PDF /JS object 76 at offset 0x426	549 bytes
`deobfuscated.js` `1a8722323e7879aff87726adabc5101b1ff8a6a308f1a0a2d4ff97597bad0d5b`	deobfuscated-js	PDF JavaScript deobfuscation pass	1215 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.