PDF malware analysis — malicious · c6ea4a4d2c1d0871

MALICIOUS

PDF

59.3 KB Created: 2006-02-16 15:03:51 -08:00 Authoring application: lice (via ubst)

MD5: 2f0d3dec11b403cbf94503a558f92732 SHA-1: deea926507c26981bced29a25373cfbab614f540 SHA-256: c6ea4a4d2c1d0871c60fb8770d817b6e828fc858f2d59ec919abd186d5c9c1e1

106 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

This PDF was flagged as malicious by ClamAV (Pdf.Exploit.Dropped-94) and a machine learning classifier. It contains embedded JavaScript, which is often used to deliver exploits or download second-stage payloads. The ML classifier's high confidence score and the ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV: Pdf.Exploit.Dropped-94 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Dropped-94
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `bbbd5de5c7a8e90d9508454a94406f14e6e53ed9ac42efbf8c29476b685afbaa`	pdf-javascript-stream	PDF /JS object 76 at offset 0x955	50772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.