PDF malware analysis — malicious · cefe8a2ace2949e6

MALICIOUS

PDF

45.3 KB Authoring application: substr

MD5: 615f93d94e38d13835c9127da1252a9c SHA-1: 04273c08ab0a24a66f405bf261d3097517953a0c SHA-256: cefe8a2ace2949e61cc82e1d1f28842a070085c606ba929a5b6b1aa09c5a90b6

76 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file was detected as malicious by ClamAV with the signature Pdf.Malware.Agent-9783731-0. Static analysis revealed embedded JavaScript, which is a common technique for delivering malware. The JavaScript action and embedded JS stream indicate that the script likely attempts to download and execute a second-stage payload.

Heuristics 3

ClamAV: Pdf.Malware.Agent-9783731-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Malware.Agent-9783731-0
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0001_000.js` `653c52a7beec6285b455eb9e56c349c547b9cb67fc80e60729e066740072ef36`	pdf-javascript-stream	PDF /JS object 1 at offset 0xB2C3	446 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.