Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3a862cd9bbcd444…

MALICIOUS

PDF

44.7 KB
MD5: 3ddbc1875557a1e153ee83d404d496a0 SHA-1: cce0170f80f54bae9c48db74e8862cd236c8a446 SHA-256: e3a862cd9bbcd444fc323ad8c33793c7ff8c70db25fca32a6052303b234091ca
84 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. ClamAV also flagged it as Heuristics.PDF.ObfuscatedNameObject, suggesting malicious intent. The embedded JavaScript is likely responsible for executing malicious actions, such as downloading further payloads or exploiting vulnerabilities within the PDF reader. The presence of XFA form elements (PDF_XFA) can sometimes be leveraged for exploitation. The URLs extracted are related to XFA and Adobe, but their reputation is unknown or benign, providing limited direct IOCs.

Heuristics 5

  • ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xci/2.6/
    • http://www.xfa.org/schema/xfa-template/2.6/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0012_000.js
a0d5fc1293aaace2431b13e85fbb391bf487ad3fce029e5fee8f70e86e3393e7		 pdf-javascript-stream PDF /JS object 12 at offset 0xA1DE 3166 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.