PDF malware analysis — malicious · e89d43244d1c6d2a

MALICIOUS

PDF

186.2 KB Created: 2010-03-03 15:54:22 +08:00 Authoring application: WPS Office 个人版 (via PDFlib 7.0.3 (C++/Win32))

MD5: 4db1691a0c7199cac320f03ac7741ca2 SHA-1: 83d8d4ff8600c1d1e128e7086e3442488e4f0f6a SHA-256: e89d43244d1c6d2ae254aea76242258de135c6753dc2dc82d2447224758bb84b

116 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1553.005 Mark-of-the-Web Bypass

The PDF file contains embedded JavaScript, indicated by the 'PDF_JAVASCRIPT' and 'PDF_JS' heuristics. The 'POLYGLOT_CHILD_PDF_STATIC_TRIAGE' heuristic suggests a secondary embedded PDF with suspicious findings. The ClamAV detection 'Heuristics.PDF.ObfuscatedNameObject' further confirms malicious intent. The embedded JavaScript is likely responsible for executing malicious actions, such as downloading and executing a second-stage payload.

Heuristics 4

ClamAV: Heuristics.PDF.ObfuscatedNameObject critical CLAMAV_DETECTION

ClamAV detected this file as malware: Heuristics.PDF.ObfuscatedNameObject
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0006_000.js` `8d8b3c31a42bcaee36cf2826e7a4664358c8f3195c744373a67ef791214c9328`	pdf-javascript-stream	PDF /JS object 6 at offset 0x18B	6603 bytes
`font_00_sfnt_off00015e76.bin` `3062d85e7d07927f12209dbb2af9eefd2687e033ff2f11bafa550c8a32a59d83`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15E76	295124 bytes
`font_01_sfnt_off0002bfaa.bin` `683f54a32e2a97c723c0d8a014e82b66682224bc66093882ad63b72931b78041`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2BFAA	22668 bytes
`polyglot_child_pdf_off00013106.pdf` `9ae3f487c3f62223a103c2edf143392240f27d4dcce34fabf07e93203c7ca2b5`	polyglot-child-pdf	Secondary PDF body inside pdf container at offset 0x13106	112607 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.