PDF malware analysis — malicious · a681d9ec4c0058b4

MALICIOUS

PDF

22.2 KB Created: 2009-04-24 09:54:29 +02:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 7.0.5 (Windows))

MD5: 008aefee3f449db4db034c2249142e6d SHA-1: 9f7051f31e809f36eb450805a1bf867fc722dd69 SHA-256: a681d9ec4c0058b45faf25f65f2af9622f54a9ef1074282ebc9955c4b1b45013

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF containing obfuscated JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection 'Heuristics.PDF.ObfuscatedNameObject' further supports the malicious nature. The JavaScript appears to be designed to execute arbitrary code, likely to download and run a second-stage payload. The obfuscation makes it difficult to determine the exact payload or final destination without further dynamic analysis.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.