Malicious PDF — malware analysis report

Static analysis result for SHA-256 db133a9dc42efc37…

MALICIOUS

PDF

2.7 KB Created: 2007-01-01 Authoring application: 6450
MD5: 223dbb8e87c791e4309eec8a3ac62cef SHA-1: cfd77b0aa2485057c48ad981c7d5e1e46a506c8b SHA-256: db133a9dc42efc3748d6997015ad776292a8d4205300ecbf3c93cd788a202f71
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 JavaScript/JScript

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including 'PDF_JAVASCRIPT' and 'PDF_JS'. The 'EXTRACTED_FILE_STATIC_TRIAGE' heuristic flags this JavaScript for obfuscation and suspicious content. ClamAV also identified this file as 'Pdf.Exploit.Agent-36014'. The embedded JavaScript is likely responsible for executing the exploit, although its specific actions are not detailed in the provided evidence. The document body is unreadable, providing no further context.

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-36014 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36014
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js
9d62d07c5a7f9469ad718c535588db12e6d9dccb8005c1de80e21133ec7628a8		 pdf-javascript-stream PDF /JS object 13 at offset 0x328 4796 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 3 long hex-escaped blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.