PDF malware analysis — malicious · c3f1f2736efde771

MALICIOUS

PDF

12.1 KB

MD5: 5952bdded6851d5399ca3f0f987b709b SHA-1: 6fa7e75c04c60178d2f15e473162a641287cc8e5 SHA-256: c3f1f2736efde771f6948e44c85e478ccfa4d3a45101eca538c476e11f663ee4

136 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious File

The file is a PDF containing embedded JavaScript, identified by ClamAV as Pdf.Exploit.Agent-36365. The embedded JavaScript stream is likely responsible for executing the exploit, leading to the malicious verdict. The specific exploit and its payload are not detailed in the provided heuristics, but the presence of JavaScript in a PDF is a strong indicator of malicious intent.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-36365 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36365
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `8285bdf1b37ebd775674ceefe3a257b39d3f408f6b0be0eac4317631cb7f24ea`	pdf-javascript-stream	PDF /JS object 76 at offset 0x369	11259 bytes
Detection ClamAV: Pdf.Exploit.Agent-36364 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.