Malicious PDF / .PHP — malware analysis report

Static analysis result for SHA-256 d945980804392702…

MALICIOUS

PDF / .PHP

11.2 KB
MD5: 194932e6a96deeff86c052f350f4fcde SHA-1: 94ce5d3fe119dd3eb5ddfc6ae323d012a4feef54 SHA-256: d945980804392702993633e291e8f5409ad0b0aa2fe7cc7c58cc6a63c673ef13
76 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Pdf.Exploit.Agent-23344. Static analysis detected embedded JavaScript within the PDF, indicating an attempt to exploit vulnerabilities. The JavaScript is likely responsible for downloading and executing a second-stage payload.

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-23344 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-23344
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0087_000.js
31e59e8b9e223d3f779e513c939bcbc420ae6bff3cd0e3d3bc7a20e10741d057		 pdf-javascript-stream PDF /JS object 87 at offset 0x105 27757 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.