PDF malware analysis — malicious · abf69e61131dc353

MALICIOUS

PDF

366.4 KB

MD5: ad668992e15806812dd9a1514cfc065b SHA-1: fa91f25a953be1b5369674e39e4313f864b3ccaa SHA-256: abf69e61131dc3535d44e0e87f186e0b1aa560eba0b4551141f2186cde1f49cc

194 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF containing embedded JavaScript, as indicated by multiple PDF-specific heuristics including PDF_JAVASCRIPT, PDF_JS, and PDF_XFA. The presence of PDF_EVAL and PDF_UNESCAPE, along with a high ML score and ClamAV detection as Pdf.Dropper.Agent-7291939-0, strongly suggests malicious intent. The embedded JavaScript likely functions as a dropper, attempting to download and execute a second-stage payload from a remote source.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 6

ClamAV: Pdf.Dropper.Agent-7291939-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7291939-0
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution
unescape() call high PDF_UNESCAPE

unescape() found — often used to decode shellcode in PDF JS exploits
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `dbf2b563944354536cd472733310ee3c9e5780686e4e5cd639764efd7ba740c1`	pdf-javascript-stream	PDF /JS object 1 at offset 0xA	67070 bytes
`stream_000_off00047995.js` `dcefc16710d335e69f60cdd8a0e174d43939d02eaa8dd4c6d7ce4ca63f06495b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47995	289498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.