Malicious PDF — malware analysis report

Static analysis result for SHA-256 c66106045759a390…

MALICIOUS

PDF

388.4 KB
MD5: e406348f71c296fc538506f8bfb1d1c4 SHA-1: 7da46e081de390d5a8057f7a4f6a8e47633e4d0d SHA-256: c66106045759a390b313957c0f3954e8946cdd53f2c57a31d8d25c6643982dc5
188 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

The PDF file contains embedded JavaScript and uses ASCIIHexDecode filters, indicating an attempt to obfuscate malicious code. ClamAV detections confirm this is a known PDF exploit, likely Pdf.Exploit.Agent-36175. The embedded JavaScript is the primary mechanism for delivering the exploit payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Exploit.Agent-36175 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36175
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
b65ac1b583382a99d317775eca22aa6eea70c32f571e23c2ff3dae060fcbe711
pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 132308 bytes
Detection
ClamAV: Pdf.Exploit.Agent-36175
Obfuscation or payload: unlikely