PDF malware analysis — malicious · bb33b8b848f648c9

MALICIOUS

PDF

813.9 KB Created: 2010-04-29 13:35:49 +08:00 Authoring application: Converting...

MD5: 4ffd1ba047f9f57c86334caae42f5dd9 SHA-1: 4d3f31c666ae4f2c95e9eb587e4a4f3f4f65f5b8 SHA-256: bb33b8b848f648c9211608087c395597f822c74eec47c741c7a62cb182a8c5a0

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The CLAMAV_DETECTION heuristic flags it as Heuristics.PDF.ObfuscatedNameObject, suggesting obfuscation techniques are used to hide malicious content. A secondary embedded PDF was also found with suspicious static findings. The presence of JavaScript strongly suggests an intent to execute malicious code, likely to download and run additional malware.

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `f384701c72b3b1871179e7da4fb2d3bedd49865bf81ee591e224c7fab41a0a2e`	pdf-javascript-stream	PDF /JS object 6 at offset 0x18B	6710 bytes
`stream_074_off00093f8a.bin` `0da6b05897346a0d7f8633939fd9a5774d4ed77bcf1b2d893178576ca64fd749`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x93F8A	495712 bytes
`icc_00_off000c9941.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0xC9941	3144 bytes
`font_00_sfnt_off000874c3.bin` `a2d81f0633182c8bc5579d9f6268f3daaa3f9d697ff4957d77e9daf69dd3b8f5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x874C3	158660 bytes
`polyglot_child_pdf_off0003a813.pdf` `cf881607a93807ced01904c73d0a2c826db19b88d0403d1acb8059fd99f5df9b`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x3A813	593816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.