PDF malware analysis — malicious · b2dc8d3360703c0a

MALICIOUS

PDF

13.2 KB

MD5: 7bb65f4caac623a1ce73a9d5e1a1f7b4 SHA-1: 17e68055a114f571300dbfc0ae8c1c0cd69146ba SHA-256: b2dc8d3360703c0a3b027777a34067e3578a07d1b6359e844204bddcfd742fc7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is detected by ClamAV as Win.Exploit.Jailbreak-1, indicating it contains an exploit. The PDF structure and embedded font stream are consistent with exploit delivery mechanisms. The exploit likely targets a vulnerability in PDF readers to achieve code execution.

Heuristics 2

ClamAV: Win.Exploit.Jailbreak-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.Jailbreak-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_cff_off00000458.bin` `9c09a2190361397794463fbdb5a8b70e0222628e60b6b4e3c613a84967b0199f`	pdf-font-stream	PDF embedded font (cff) at offset 0x458	40133 bytes
Detection ClamAV: Win.Exploit.Jailbreak-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.