Malicious PDF — malware analysis report

Static analysis result for SHA-256 adcfea769e832789…

MALICIOUS

PDF

6.0 KB
MD5: d35044b1ffcbed1d2f30de2521b10d3c SHA-1: d3c33cefb1386fb47cab7d4938ac23e4a10e967f SHA-256: adcfea769e83278928f53f39f9ee3c8300c07fbf2c8568bd1880bbf4d0faae8f
106 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV due to obfuscated JavaScript content. The presence of embedded JavaScript actions indicates an attempt to execute arbitrary code upon opening the document, likely to download and run a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Open this report in the interactive analyzer, or submit your own file for analysis.