PDF malware analysis — malicious · bbd9a21a3e079e8e

MALICIOUS

PDF

77.8 KB Created: 2009-08-26 23:02:49 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)

MD5: 7942784490a7d3ae168a6a440e2fe0a0 SHA-1: faf34bfe1045bdb3652b407b9ab3c656dcca83d6 SHA-256: bbd9a21a3e079e8ecee79d1fbaddc1add512323f7a00883d4ce2be209e026291

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The PDF file exhibits multiple JavaScript-related heuristic firings, including obfuscated content, indicating malicious intent. The presence of embedded JavaScript streams, particularly a large one (javascript_obj0095_003.js), suggests the execution of code to download and run further malicious components. The ClamAV detection of 'Heuristics.PDF.ObfuscatedNameObject' further supports the malicious nature of the file.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0092_000.js` `bebe294d5cd5b45bf87c4265051d43b3404106a807be0b53017aa46c3f3fd3c8`	pdf-javascript-stream	PDF /JS object 92 at offset 0xF58E	165 bytes
`javascript_obj0093_001.js` `df96b7db9a473d84f9a20a99c48f333f2726d0d81575f6a0884312595943ed43`	pdf-javascript-stream	PDF /JS object 93 at offset 0xF65C	153 bytes
`javascript_obj0094_002.js` `91a9b866f71c2056c0539329ec02205a6971cd43c508dd936b99414b17f2db5e`	pdf-javascript-stream	PDF /JS object 94 at offset 0xF72D	244 bytes
`javascript_obj0095_003.js` `e7017e94912d8d12cd6bec0e2e2bb1817fe648b50ed531363e6b3e46700f899d`	pdf-javascript-stream	PDF /JS object 95 at offset 0xF82B	23901 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.