Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0bf0c40cb54df30…

MALICIOUS

PDF

45.2 KB
MD5: 0383c04ede7b8f3ac2a4339aa7492423 SHA-1: 2ac23f425d85e9bc24c0c0c7b22b78c7a6fd423e SHA-256: d0bf0c40cb54df3029733f103166e8b3377f75f3ea6c403607eac839dcdcda65
114 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for obfuscated objects and an ML classifier indicating maliciousness. Embedded JavaScript, detected as a PDF-JavasScript action and an embedded JS stream, is the likely mechanism for malicious activity. The primary intent appears to be downloading and executing a secondary payload, as indicated by the presence of obfuscated JavaScript within the PDF structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9248

Heuristics 4

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
39c0f7badeaec63dd00a9ac761a68415871f19a477ff56911f52892fcad6b8ee		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1F5 3966 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.