Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6878b460504382a…

MALICIOUS

PDF

76.1 KB Created: 2010-01-04 19:42:13 Authoring application: PDF Library 2.2.5 (via PDF Library 8.1.7)
MD5: 4d75642825d2fbd279a39d588cc373d8 SHA-1: 14c37a5f9666eb51af3537c7911ed0c7757281b1 SHA-256: b6878b460504382aca58333897a20250921dc986204cfa9f39aede9840abaeb2
98 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The file is a PDF document identified by ClamAV as Pdf.Exploit.Agent-36110. It contains embedded JavaScript, indicated by heuristic firings for PDF_JAVASCRIPT and PDF_JS. The presence of ASCIIHexDecode filter with exploit indicators suggests the JavaScript is used to exploit a vulnerability within the PDF reader. The exact behavior of the JavaScript is not fully discernible due to obfuscation, but it is highly likely to be a downloader or dropper for a second-stage payload.

Heuristics 5

  • ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0007_000.js
097bcce4412c7453a7673b86c0142e9d4665fd3a99ef790918e364cbf5340df4		 pdf-javascript-stream PDF /JS object 7 at offset 0x1A5 38451 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.