PDF malware analysis — malicious · a6e98e0dedab0759

MALICIOUS

PDF

12.3 KB

MD5: a93210ed41bf370e92faa6aee1aaf80f SHA-1: 0edc8f731587e3916fa6d964f0f4e157c75ef430 SHA-256: a6e98e0dedab0759c7d728ad1127dc1e07d0be0016ab1f6753bfde9aa2ec32fd

106 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, which identified it as Win.Trojan.Agent-36281. Heuristics indicate the presence of embedded JavaScript, suggesting an attempt to exploit vulnerabilities or download further malicious content. The primary detection is based on the embedded JavaScript content and the ML classification.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Win.Trojan.Agent-36281 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Agent-36281
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `e0b3af8fb77f295d8f27171502dbf676bc52d708bc80e535d1d863082bdef7dd`	pdf-javascript-stream	PDF /JS object 76 at offset 0x369	11510 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.