PDF malware analysis — malicious · c6b8c22624afa6b8

MALICIOUS

PDF

10.4 KB

MD5: 775636b2cce1bc39cae8098d9b12ca14 SHA-1: 9557952ba1f09eb478a9574fdffaa192cac7fcb7 SHA-256: c6b8c22624afa6b8c0b2c75b05f89ed31baa7fdd64536392036c3e8e641ee056

78 Risk Score

Malware Insights

MITRE ATT&CK

T1555 Credentials from Password Stores T1059 Command and Scripting Interpreter

The PDF file was flagged by ClamAV with 'Heuristics.PDF.ObfuscatedNameObject', indicating a suspicious structure. Furthermore, it contains an embedded file, 'embedded_file_obj0001.bin', which is a common technique for delivering secondary payloads. The document body content is heavily obfuscated and unreadable, providing no direct clues to the user-facing lure.

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Embedded file low PDF_EMBEDDED

PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_file_obj0001.bin` `de525d0126be9bed94607e99b834efbe900f92b8c655b92824c00354ee3142f3`	pdf-embedded-file	PDF EmbeddedFile object 1 at offset 0x7A	13408 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.