PDF / .PHP malware analysis — malicious · ea834b84521d622d

MALICIOUS

PDF / .PHP

37.8 KB Created: 2010-04-11 20:37:02 +04:00 Authoring application: TCPDF (via TCPDF 4.8.032 (http://www.tcpdf.org))

MD5: 51ae9adeece703c7df3a08bcf0095173 SHA-1: d8153da64470fa0387e7b7aa9e3ec50bede46e75 SHA-256: ea834b84521d622dda8899b155778209360bf6b9a536f38e75bf279e5670d5cd

84 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution: Malicious File

The file is identified as malicious by ClamAV with the signature Pdf.Exploit.Agent-22584. Static analysis revealed embedded JavaScript within the PDF structure, indicating an attempt to exploit vulnerabilities. The presence of JavaScript actions and streams strongly suggests that the file is designed to execute malicious code upon opening, likely downloading and running a second-stage payload. The PDF structure itself does not contain user-readable content, further supporting its role as a malicious container.

Heuristics 4

ClamAV: Pdf.Exploit.Agent-22584 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-22584
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT

Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0010_000.js` `eaf81e3cf9a26c29915df2a1e4b8fb1913da19468728b8c974997ca65231270b`	pdf-javascript-stream	PDF /JS object 10 at offset 0x8CB6	1346 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.