PDF malware analysis — malicious · b6979490343c1434

MALICIOUS

PDF

7.4 KB Created: 2010-09-16 18:55:19 Authoring application: Tolhipezorojpagiwaqo (via acfcaSeueganadazaqeav)

MD5: 98b94520b3d2a3bc584825cce63df6d8 SHA-1: 04a5b77d982bc05864739ae5edaa7e3817a18427 SHA-256: b6979490343c143492b6b371c41546c3c754f74e9288f1c9f9549381cec508ff

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged as malicious by both ML classifiers and ClamAV with the rule 'Heuristics.PDF.ObfuscatedNameObject'. It contains embedded JavaScript, indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics. The JavaScript stream, though truncated, suggests an attempt to execute code, which is a common technique for delivering further malicious payloads. The ML classifier output of 0.995397 indicates a high likelihood of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `e2d41866c9fb013feb60cefe8b41892c7277decb0774febb940ce493b1221654`	pdf-javascript-stream	PDF /JS object 11 at offset 0x1387	2332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.