PDF malware analysis — malicious · b26a02b14d212cf7

MALICIOUS

PDF

326.2 KB Created: 2015-07-30 03:45:38 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: cf9cea8d633d0d1acdadae44092fc030 SHA-1: 9a5a58f6a46d1fc2988c606f053c964e6d1c167d SHA-256: b26a02b14d212cf7ea82d209317336dca4c8e970d89c732ae80865645151c27a

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file triggered multiple high and critical severity heuristics, including a ClamAV detection for 'Unix.Trojan.PhpBackdoor-9354530-2' and a PDF eval() call. The ML classifier also strongly indicated maliciousness. These indicators suggest the PDF is designed to exploit vulnerabilities and likely download additional malicious content, consistent with a backdoor trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9895

Heuristics 2

ClamAV: Unix.Trojan.PhpBackdoor-9354530-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Unix.Trojan.PhpBackdoor-9354530-2
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000c18f.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xC18F	264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.