Malicious PDF — malware analysis report

Static analysis result for SHA-256 aac4476170421c77…

MALICIOUS

PDF

46.6 KB Created: 2009-11-07 00:39:49 +03:00 Authoring application: wordsHiddenWord (via aebb462e657b9e288cbfe408fc1a9dd5)
MD5: ad6a2521e1ffe2fe0a7c59e30f48b8cd SHA-1: f2c622b6b21ee4072d108b44081571fe7cc30f1a SHA-256: aac4476170421c7704a95871a4ea789ccf4291641cf53d40c7d453fc85db7b6f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, with a high-confidence heuristic indicating an eval() call. This suggests the script is designed to execute arbitrary code. The ClamAV detection of 'Pdf.Exploit.Agent-3084' further confirms its malicious nature. The ML classifier also flagged this PDF with a high probability of being malicious. The document body contains obfuscated text and what appears to be a list of words, possibly for social engineering or to bypass basic content analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Exploit.Agent-3084 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-3084
  • eval() call high PDF_EVAL
    eval() found — commonly used for obfuscated exploit execution (matched inside decoded stream)
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0015_000.js
2de805824ff3391f411dbb219e90c528e9427faa7775074b48b5700885e11206		 pdf-javascript-stream PDF /JS object 15 at offset 0x26E8 4096 bytes
javascript_obj0016_001.js
dbb7559785f5225256a9ffb9411eecaa0f5912c2255c2d2545311349d3eb8954		 pdf-javascript-stream PDF /JS object 16 at offset 0xB46D 40 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.