PDF malware analysis — malicious · bc4724596248c833

MALICIOUS

PDF

11.5 KB

MD5: cf82d7f3235301ea0f33045e7925cdaf SHA-1: b8a56500c082fd05be45d273acc0c55e5849f44f SHA-256: bc4724596248c8336ae4a7054c28083d4de06e7f885e819592d01a5a32b77e23

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged by ClamAV as Pdf.Dropper.Agent-7217149-0 and a machine learning model assigned a high probability of maliciousness. Heuristics indicate the presence of embedded JavaScript, which is a common technique for dropper malware to download and execute additional malicious payloads. The document body content is unreadable, but the combination of heuristics and ClamAV detection strongly suggests a malicious dropper.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7217149-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7217149-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0045_000.js` `5361eb61bf05adb6c92f025521334770053895c9ed44851094d286d481d3a3d3`	pdf-javascript-stream	PDF /JS object 45 at offset 0x193	27701 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.