PDF malware analysis — malicious · cce39a31b61d0df0

MALICIOUS

PDF

4.5 KB Created: 2009-21-08 31:27:54 +03:00 Authoring application: fackoPDF 8.01 (via BCL macroPDF 6.02)

MD5: 5744fe8b87238128ad5fac99f84af1c6 SHA-1: 5b2ff8acfba62ee553163cc6ef140654c172036a SHA-256: cce39a31b61d0df0df974c1cffa2a8d2b9445d38ff06e93d027b948891eef658

78 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection of 'Pdf.Dropper.Agent-1828946' strongly suggests malicious intent. The embedded JavaScript is likely responsible for downloading and executing a secondary payload, a common technique for PDF-based malware delivery. The PDF_IMAGE_ONLY_LURE heuristic indicates the document may be designed to trick the user into interacting with it, possibly by displaying an image that prompts further action.

Heuristics 4

ClamAV: Pdf.Dropper.Agent-1828946 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-1828946
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE

PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0015_000.js` `2a191e8809bc97870ddd90291f8b0029dea2dd9504a2663bf49c13911af40223`	pdf-javascript-stream	PDF /JS object 15 at offset 0x317	9188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.