PDF malware analysis — malicious · d555cf934731d26c

MALICIOUS

PDF

13.0 KB

MD5: a8c01f533f5222714b69c0cfe153dd1c SHA-1: 8a955f3096e64647f58eb71a86be1e7a58ec0fce SHA-256: d555cf934731d26c724eeca6faf7ee332622f3213b7c10b4aa32e009c4a98b84

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.003 Phishing: Spearphishing Attachment T1204.002 Malicious File Execution: Malicious PDF

The file was identified as malicious by a machine learning classifier and ClamAV, which specifically detected it as 'Win.Exploit.Jailbreak-1'. This indicates the PDF is designed to exploit a known vulnerability, likely leading to arbitrary code execution upon opening.

Machine Learning

Nyx PDF Classifier malicious score 0.9056

Heuristics 2

ClamAV: Win.Exploit.Jailbreak-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.Jailbreak-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_cff_off00000458.bin` `3ae951534758b73275db5c09a715338fc4d56376ade87be27b197b7401b90486`	pdf-font-stream	PDF embedded font (cff) at offset 0x458	40077 bytes
Detection ClamAV: Win.Exploit.Jailbreak-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.