Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0d6af2e98f13c20…

MALICIOUS

PDF

31.4 KB
MD5: dea1cd642434504a5d6c8b82fbfd7f0f SHA-1: 9157b93da929f130ab9f4e094fc6ecd13f92a61d SHA-256: e0d6af2e98f13c209c78c74c62ae5d4dc7334c721e888179b14ac94e05cf754f
194 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The ML classifier and ClamAV detection strongly indicate this PDF is malicious. The presence of embedded JavaScript and the 'Doc.Downloader.Generic-6698421-0' signature suggest it functions as a downloader for additional malware. The embedded file 'doc.docm' is also flagged by ClamAV, reinforcing the downloader behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX
    Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
doc.docm
11eb9057e3ac59a39d9d9a7d2e3414796d028c2b59639f15068cd3cfa3d61a52		 pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x341 15521 bytes
Detection
ClamAV: Doc.Downloader.Generic-6698421-0
Obfuscation or payload: unlikely
javascript_obj0001_000.js
99c81959528cd7fe8df813abd4b7ea6c87fb3f4102dc3037150d853a363b432f		 pdf-javascript-stream PDF /JS object 1 at offset 0xA 58 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.