PDF malware analysis — malicious · c42e91083007f3a9

MALICIOUS

PDF

16.2 KB Created: 2010-03-05 15:19:50 Authoring application: Laxiwoveja

MD5: bd6098d27f7e885a74616c67158aaf8e SHA-1: 6fdcb6a5ed184790f19f6c8f52efae105aff01ad SHA-256: c42e91083007f3a9173acb6af92ea4cefcdfb2bf0fb8e310ddad4475bd8c2c8f

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript

The critical ClamAV heuristic 'Pdf.Exploit.Agent-36066' strongly indicates malicious intent. Additionally, low-severity heuristics for PDF JavaScript actions and embedded JS streams confirm the presence of executable code within the PDF. The embedded JavaScript, though large, is the primary mechanism for exploitation, likely leading to the download or execution of a secondary payload. The document body content is not human-readable, providing no further clues to the lure.

Heuristics 3

ClamAV: Pdf.Exploit.Agent-36066 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36066
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0022_000.js` `22e7b9b95199cc294a88baec03e968aa698abb89fdbf202e98b946c7b2639771`	pdf-javascript-stream	PDF /JS object 22 at offset 0x30AF	971255 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.