PDF malware analysis — malicious · c49ac88b7d07a964

MALICIOUS

PDF

326.2 KB Created: 2015-08-07 16:48:33 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org))

MD5: dd826153776a2b187478b04e758983a0 SHA-1: c4f81d8ea9bbfb8ae08be11afecf233198dda520 SHA-256: c49ac88b7d07a964ea201cca48c47267a3fd5d12acd44b987d923c421ac3ec67

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains a high-severity heuristic firing for PDF_EVAL, indicating the presence of an eval() call, which is often used to execute arbitrary code. Additionally, a critical ClamAV detection identifies the file as 'Unix.Trojan.PhpBackdoor-9354530-2'. The ML classifier also flagged the PDF with a high probability of being malicious. These indicators strongly suggest the PDF is designed to exploit a vulnerability and deliver a backdoor.

Machine Learning

Nyx PDF Classifier malicious score 0.9895

Heuristics 2

ClamAV: Unix.Trojan.PhpBackdoor-9354530-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Unix.Trojan.PhpBackdoor-9354530-2
eval() call high PDF_EVAL

eval() found — commonly used for obfuscated exploit execution

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000c18f.bin` `a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xC18F	264072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.