PDF / .PHP malware analysis — malicious · c058c4ddd0902cba

MALICIOUS

PDF / .PHP

37.8 KB Created: 2010-04-11 20:49:47 +04:00 Authoring application: TCPDF (via TCPDF 4.8.032 (http://www.tcpdf.org))

MD5: 850409530fc421c5db4bdfab8a45cf83 SHA-1: 6ac4e86f548392098663ede69bbce8102509315f SHA-256: c058c4ddd0902cba9e992390974dccb4b24cc3afdfafdfb7649da4a8007cea36

84 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1559.001 Component Object Model Hijacking

The file is detected as malicious by ClamAV with the signature Pdf.Exploit.Agent-22614. Static analysis revealed embedded JavaScript within the PDF, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. This JavaScript is likely responsible for exploiting a vulnerability within the PDF reader to execute arbitrary code. The specific exploit and its payload are not detailed in the provided evidence, leading to an unknown family attribution and moderate confidence.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-22614 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-22614
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `615e7ae78ed57367932bc14cad3c47180d679f5d2c39d860287b75673f0c5520`	pdf-javascript-stream	PDF /JS object 10 at offset 0x8CC0	1346 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.