Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa023a501abec46d…

MALICIOUS

PDF

46.2 KB
MD5: 0d3dc50d6a65582c38721793c148da5c SHA-1: db93bfb76746e77eefd7c5ef19b6b7a440ed1998 SHA-256: aa023a501abec46d35f321a159bf088bb3a95d945d37df4e31ea31395fb03661
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The presence of XFA forms also suggests a complex document structure often used for malicious purposes. While the document body is unreadable, the JavaScript stream is the primary indicator of malicious activity. The embedded JavaScript likely attempts to download and execute a second-stage payload or exploit a vulnerability within the PDF reader. The ClamAV detection 'Heuristics.PDF.ObfuscatedNameObject' further supports the malicious nature of the file.

Heuristics 5

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
9fbe15ecad14eb60181b6b6b1d2affddbb19d50cf543cfa2020abcefe4b3fdbd		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1F1 4422 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.