PDF malware analysis — malicious · bd87de57c8859778

MALICIOUS

PDF

12.9 KB

MD5: ff6469dab021f2a76fb5ebea87cc94cf SHA-1: f59d1ed3529cda9175b9918f97cc0671390e0d03 SHA-256: bd87de57c8859778f25b1694d1d46fec2600fc410640841e61b32b3cb2bf84b5

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV heuristic 'Pdf.Exploit.Dropped-94' and the 'PDF_METADATA_EVAL_STAGER' heuristic indicate that this PDF contains JavaScript designed to exploit a vulnerability. The embedded JavaScript stream is likely responsible for decoding and executing the exploit, which in turn probably downloads and runs a second-stage payload. The PDF metadata also contains JavaScript, further supporting the exploit stager finding.

Heuristics 4

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
PDF metadata JavaScript eval stager high PDF_METADATA_EVAL_STAGER

PDF JavaScript reads document metadata fields such as title, subject, or producer, decodes character data with parseInt/String.fromCharCode style helpers, and evals the recovered stage. This is a high-signal exploit-kit staging pattern.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `2b5489705514cbb8a161f002d1786fa0d42d7bc33ed2414754c53ff66953ed9b`	pdf-javascript-stream	PDF /JS object 76 at offset 0x3164	331 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.