Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba2df012d33e8a04…

MALICIOUS

PDF

3.5 KB
MD5: 3c73f57d985441683ef87f592b2aa2eb SHA-1: 37debc31d7cd5b15ac619151d34301d03f7d56f0 SHA-256: ba2df012d33e8a047718fd5d0f056992a9cbcb2b0af0c874a6226a7cd7d297c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment

The PDF file contains embedded and obfuscated JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT and PDF_JS. The use of ASCIIHexDecode filter with exploit indicators further suggests malicious intent. ClamAV also flagged this as Heuristics.PDF.ObfuscatedNameObject, confirming its malicious nature. The primary attack vector appears to be the execution of malicious JavaScript embedded within the PDF.

Heuristics 4

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.