PDF / .HTM malware analysis — malicious · a767018cf140f859

MALICIOUS

PDF / .HTM

16.2 KB Created: 2010-03-05 15:19:50 Authoring application: Laxiwoveja

MD5: a5936b92270594d1dd12cefdb4887b24 SHA-1: 0f588c850f137eafa157472130fccf23cf38db49 SHA-256: a767018cf140f859ff18974844494ec15f323b96cda0b128e33e2f4fc86697b5

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is identified as a malicious PDF by ClamAV with the signature Pdf.Exploit.Agent-36066. Static analysis detected embedded JavaScript, indicating an attempt to exploit a vulnerability within the PDF reader. The JavaScript action and embedded JS stream are strong indicators of a malicious payload delivery mechanism. The exact nature of the JavaScript's execution is not fully discernible due to obfuscation, but it is highly probable that it downloads and executes a second-stage payload.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36066 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36066
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0022_000.js` `22e7b9b95199cc294a88baec03e968aa698abb89fdbf202e98b946c7b2639771`	pdf-javascript-stream	PDF /JS object 22 at offset 0x30AF	971255 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.