PDF / .SWA malware analysis — malicious · c0df459f5bfd356e

MALICIOUS

PDF / .SWA

6.6 KB Created: 2010-09-03 08:30:58 Authoring application: Wigejobawaqivlirore (via 14a3cLoxidakeneveb)

MD5: 8a2d3d98cf42b734c7e7fa7c66fb1c0c SHA-1: 6b424b9c1da457e30edcec9505e2ee8c467cce28 SHA-256: c0df459f5bfd356ed2ca116498527bc3ef3d515c2d2f5c52752aec45ce3db602

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains obfuscated JavaScript, identified by the 'PDF_PAGE_WORD_XOR_EVAL_STAGER' heuristic, which is designed to execute arbitrary code. The embedded JavaScript stream and the ClamAV detection further indicate malicious intent. The primary function appears to be the execution of a second-stage payload via the embedded JavaScript.

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Page-word XOR JavaScript eval stager high PDF_PAGE_WORD_XOR_EVAL_STAGER

PDF JavaScript enumerates rendered page words with getPageNthWord/getPageNumWords, extracts encoded byte fragments, XOR-decodes the stage with char-code helpers, and evals the result. This is an old exploit-kit staging pattern and is not normal document JavaScript.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `f41461c6d0ad7c5b3366f5afcb8bd0df9b874c9b0f5ff46847255e6ad0726ba1`	pdf-javascript-stream	PDF /JS object 10 at offset 0x11A1	1999 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.