PDF malware analysis — malicious · ab89ed10e337ef67

MALICIOUS

PDF

4.0 KB

MD5: c6a436d14b449f06f6f8a35a5b5f943d SHA-1: fe15c7680cc55c1a0d77ef9c4e4eacf17df51bb8 SHA-256: ab89ed10e337ef67ddcc9832f26a2ec407e18419528071b2a7629a779ba03c16

136 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER' indicates that the PDF is designed to execute code via an annotation subject. This is further supported by the 'PDF_JAVASCRIPT' and 'PDF_JS' firings, confirming the presence of embedded JavaScript. The ClamAV detection 'Pdf.Exploit.Agent-36062' strongly suggests this is a known exploit. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, a common technique for initial access.

Heuristics 4

Annotation subject percent-decoding eval stager critical PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER

OpenAction JavaScript forces annotation enumeration, reads an annotation /Subject payload with getAnnots(), rewrites marker bytes into percent escapes, decodes it with unescape(), and dispatches it through eval. This is a high-confidence exploit-kit staging pattern. It is intentionally not mapped to CVE-2009-1492 unless getAnnots() itself carries the crafted integer or long argument shape for that vulnerability.
ClamAV: Pdf.Exploit.Agent-36062 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36062
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `068944f8c011a88ab770b45c6de142b9305a1f515d410204d5eadd9ac2b5bfb3`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A2	373 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.