PDF / .SWA malware analysis — malicious · c36dadf6503c909d

MALICIOUS

PDF / .SWA

7.8 KB Created: 2010-09-21 20:42:51 Authoring application: Doxifajahigjobe (via 3c218Tomawaliuepizi)

MD5: 02e4136e6d7966d3f3b775f791157558 SHA-1: f286ba58a53218060e1c7f2b002f4bf6079b08f5 SHA-256: c36dadf6503c909d59ed0b3c862bc9d67a62de93d89fe071852c6337ce9a7fcd

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristic firings. The 'CLAMAV_DETECTION' heuristic with 'Heuristics.PDF.ObfuscatedNameObject' further confirms its malicious nature. The presence of JavaScript suggests an attempt to execute arbitrary code, commonly used to download and run additional malware. The document body is heavily obfuscated and does not provide clear textual lures.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0011_000.js` `9106999da8553f6c6b05a4ae46a0e61bbc3c0afca5556084b61a1c3623a2a08e`	pdf-javascript-stream	PDF /JS object 11 at offset 0x133F	3122 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.