PDF malware analysis — malicious · e49f9d6bd5dafaeb

MALICIOUS

PDF

12.7 KB

MD5: c09b359ff4a37d2f3a8836b272139ef8 SHA-1: 236c5fd239c460381b6a5fbcac2f2da83356fba0 SHA-256: e49f9d6bd5dafaeb372e2fe349350f9cac456b2dba7edebe58464d583c3c9619

106 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically detecting an embedded JavaScript stream. This JavaScript is likely responsible for exploiting a vulnerability within the PDF reader to execute arbitrary code, a common technique for downloading and running further malicious content. The high ML score and ClamAV detection strongly indicate a malicious intent, likely related to the Pdf.Exploit.Pdfka-9 family.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0076_000.js` `6a1110d5a5d30633811c8bc854c6d106b837d00d6aa9d7567bc77c5a5d1fa079`	pdf-javascript-stream	PDF /JS object 76 at offset 0x369	11900 bytes
Detection ClamAV: Pdf.Exploit.Pdfka-9 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.