Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2f3761729fd219b…

MALICIOUS

PDF

64.8 KB Created: 2010-07-29 12:40:22 Authoring application: PDF Editor  - Foxit Software
MD5: dee875e400fed36667b3c121a31dadf1 SHA-1: 4e73b5555c32b5c54ab7ec51790f1f523c0ba872 SHA-256: d2f3761729fd219b15783e0d0d9886b1df8a25d4ba2831626536bd588e80cb8e
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious JavaScript

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ClamAV detection for 'Heuristics.PDF.ObfuscatedNameObject' further suggests malicious intent. The embedded JavaScript stream, named 'javascript_obj0006_000.js', is likely responsible for executing malicious code, potentially downloading a second-stage payload. The document body is heavily obfuscated and unreadable, providing no direct clues to the lure.

Machine Learning

  • Nyx PDF Classifier clean score 0.0076

Heuristics 3

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0006_000.js
f46231e38442dfa44c6852d31e76943e70c9a8e8cdbd53062ab6d3b7e3be046f		 pdf-javascript-stream PDF /JS object 6 at offset 0x18B 6710 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.