PDF malware analysis — malicious · c5a897efa7f150bb

MALICIOUS

PDF

77.4 KB Created: 2009-08-26 23:02:49 Authoring application: Scribus 1.3.3.13 (via Scribus PDF Library 1.3.3.13)

MD5: 9dfd077fb3e2f8f7b87e972b50537a5f SHA-1: fd6e997001728f312bc47adae64a01cbc17446f3 SHA-256: c5a897efa7f150bb4b65304059aabee6441d2b70fab9c6276294edb9ef0a419f

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Dropper.Agent-7301266-0'. Embedded JavaScript streams were also detected, indicating the file's likely purpose is to download and execute a second-stage payload. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.8846

Heuristics 3

ClamAV: Pdf.Dropper.Agent-7301266-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7301266-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0087_000.js` `e7017e94912d8d12cd6bec0e2e2bb1817fe648b50ed531363e6b3e46700f899d`	pdf-javascript-stream	PDF /JS object 87 at offset 0xF22C	23901 bytes
`javascript_obj0088_001.js` `91a9b866f71c2056c0539329ec02205a6971cd43c508dd936b99414b17f2db5e`	pdf-javascript-stream	PDF /JS object 88 at offset 0x12942	244 bytes
`javascript_obj0089_002.js` `df96b7db9a473d84f9a20a99c48f333f2726d0d81575f6a0884312595943ed43`	pdf-javascript-stream	PDF /JS object 89 at offset 0x12A42	153 bytes
`javascript_obj0090_003.js` `bebe294d5cd5b45bf87c4265051d43b3404106a807be0b53017aa46c3f3fd3c8`	pdf-javascript-stream	PDF /JS object 90 at offset 0x12B15	165 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.