PDF malware analysis — malicious · c46f1fc7d9092362

MALICIOUS

PDF

12.9 KB Created: 2010-07-30 03:03:35 Authoring application: PDF Editor - Foxit Software

MD5: 89f5b803fae1e117aa792c170ace96d1 SHA-1: b22eff82e12e0c676695384584cd5bd34517ee2e SHA-256: c46f1fc7d9092362f88239ff2766b2785b189f93d2738dcde04a98b8e4300d68

130 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment

The file is a PDF document that has been flagged by ClamAV for obfuscated objects, indicating a likely exploit attempt. The presence of embedded files further supports this, suggesting the PDF is a dropper for malicious content. The PDF Editor metadata is likely a lure. The primary IOC is the file's SHA256 hash.

Heuristics 3

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `c5ae70af712c8e1c1062f5f60f3942d60b5b44bedb2a3c82a124431c3545ec63`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x7E	13408 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`u.pdf` `5d409ce5281334d03fbca7cdb17e718d411bfb83ce8dd8df5568bbc8fa10ec91`	pdf-embedded-file	PDF EmbeddedFile object 11 at offset 0x431	10627 bytes
Detection ClamAV: Heuristics.PDF.ObfuscatedNameObject Obfuscation or payload: unlikely
`ul.pdf` `cd618b57f4ec9d895a15e420af4dba98dba25e4b24c21be6b63ab7bf78ccdbef`	pdf-embedded-file	PDF EmbeddedFile object 11 at offset 0x433	12014 bytes
Detection ClamAV: Heuristics.PDF.ObfuscatedNameObject Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.