PDF malware analysis — malicious · d38fa276f58ce35d

MALICIOUS

PDF

13.2 KB

MD5: 0e269848ec51a1cedc4ba018a6198150 SHA-1: 5723d2b5812fd8cbc5b47e9b3e17f7e59d525ebc SHA-256: d38fa276f58ce35d62a7eb3e12ea2009f6e4743de2805a84b4ac1df0381ade95

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Win.Exploit.Jailbreak-1, indicating it contains an exploit. The PDF structure and embedded font stream are consistent with exploit delivery mechanisms. The exploit likely targets a vulnerability in PDF rendering to achieve code execution.

Heuristics 2

ClamAV: Win.Exploit.Jailbreak-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.Jailbreak-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_cff_off00000458.bin` `373244e51680320940dbce66af6c96883781e879514513057fc4f1d0a7bf54e7`	pdf-font-stream	PDF embedded font (cff) at offset 0x458	40357 bytes
Detection ClamAV: Win.Exploit.Jailbreak-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.