PDF malware analysis — malicious · c7180ccd87b8aecf

MALICIOUS

PDF

46.1 KB

MD5: fdad1bbd3bdaa289fc11b1659b1d9253 SHA-1: 7a4bc0d8ff0bcbf41c1c72b77a0602dfc9ffc4b4 SHA-256: c7180ccd87b8aecf1ff00b2d8df3b6fafb32e9ae21434bc20810830a9579e230

114 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript, flagged by multiple heuristics, and the ML classifier strongly indicates maliciousness. The document body presents a fake Adobe Reader update prompt, a common social engineering lure. The embedded JavaScript is likely responsible for executing the malicious payload, although its specific actions could not be fully determined due to obfuscation.

Machine Learning

Nyx PDF Classifier malicious score 0.9588

Heuristics 5

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xdp/
- http://www.xfa.org/schema/xci/2.6/
- http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0012_000.js` `ae66c8a2fcfa3e55620e8273f6f2da4a92ef6fa12240ab01d99713518faac6c3`	pdf-javascript-stream	PDF /JS object 12 at offset 0xA263	4425 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.