Malicious PDF — malware analysis report

Static analysis result for SHA-256 acd0bbfc634cb861…

MALICIOUS

PDF

54.8 KB Created: 2009-09-02 02:27:58 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)
MD5: ba388c2879f3ee79b23f77dca55710c8 SHA-1: 39f691a5395a0891e8397972b5a0f57523f96355 SHA-256: acd0bbfc634cb86166d0aa021798d7cb9381f3394ba655bf0d204bf4b74f86f7
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged as malicious by a machine learning classifier and ClamAV, indicating it contains malicious content. The presence of embedded JavaScript streams, specifically `javascript_obj0058_000.js`, suggests the PDF is designed to execute code. This JavaScript is likely responsible for downloading and executing a second-stage payload, a common technique for malware delivery. The PDF structure itself does not contain readable text, indicating it's likely a lure or a container for the malicious script.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9200

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7292245-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7292245-0
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0058_000.js
db1d5dc8fa34e1ed380b514bc2964b83b8a174c24f955dc159b68243001b85ea		 pdf-javascript-stream PDF /JS object 58 at offset 0x9977 23767 bytes
javascript_obj0059_001.js
6999885f0ee23a9ff63130343fa50b09346a37ba4b4e78462859626456d252ed		 pdf-javascript-stream PDF /JS object 59 at offset 0xD01F 223 bytes
javascript_obj0060_002.js
0474d36fe33239f75afbaa2e3e2d64c54cb7335e7a9a8102f6da764af99c571c		 pdf-javascript-stream PDF /JS object 60 at offset 0xD11E 163 bytes
javascript_obj0061_003.js
1c064c41e97631ffc3893429b256ae7d80faa5368ef1c03934efded7cb989266		 pdf-javascript-stream PDF /JS object 61 at offset 0xD1ED 183 bytes
javascript_obj0062_004.js
6c78e949bfae4420dd2d03dbdb3d62ff119538cce5213d6c880fe6823f34fdec		 pdf-javascript-stream PDF /JS object 62 at offset 0xD2B7 221 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.