Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3fe67c714b7d4cd…

MALICIOUS

PDF

12.4 KB
MD5: 2709a9bbc4ea5e4787193bd772e66d3b SHA-1: 14e17e53bf694ea8aa52c7de9ca29c2e2fdca30e SHA-256: b3fe67c714b7d4cd49ae8ecc525f7a73c9b32d8a05db3537d617db2705263775
108 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Exploit.Agent-36723' and a high ML score. It contains embedded JavaScript, indicating an attempt to exploit vulnerabilities within the PDF reader to execute malicious code. The primary attack vector appears to be leveraging a PDF exploit to run arbitrary code.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-36723 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36723
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0076_000.js
89af30b2011ede8e83d69dd65a9937fce6e1316a23a7455870c972d115022ffe		 pdf-javascript-stream PDF /JS object 76 at offset 0x369 11636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.