Malicious PDF — malware analysis report

Static analysis result for SHA-256 de2b5afc3a36d2b5…

MALICIOUS

PDF

69.3 KB
MD5: e32c15018db21173289603c504dd855c SHA-1: 46ddac8297615da79b06bdbee94813e499ccfeb8 SHA-256: de2b5afc3a36d2b53c3777218d9bcc107c67167775d2a4d508f7d16676377749
106 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: Malicious File

This PDF file was detected as malicious by ClamAV and a machine learning classifier, indicating a high likelihood of exploit activity. Heuristics indicate the presence of embedded JavaScript, which is commonly used in PDF exploits to download and execute further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Exploit.Agent-36388 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36388
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.